CVE-2021-39149

Name of the Vulnerable Software and Affected Versions XStream versions prior to 1.4.18

Description The issue allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. This can be done when using affected versions of XStream, a library to serialize objects to XML and back again. Users who set up XStream's security framework with a whitelist limited to the minimal required types are not affected.

Recommendations For versions prior to 1.4.18, update to version 1.4.18 or later, which uses a whitelist by default instead of a blacklist, to mitigate the risk of arbitrary code execution. As a temporary workaround, consider setting up XStream's security framework with a whitelist limited to the minimal required types to prevent exploitation.