XStream is vulnerable to an Arbitrary Code Execution attack

Vulnerability

XStream versions up to and including 1.4.17 are vulnerable to arbitrary code execution via a deserialization attack. The library, when used without a configured security framework whitelist, processes type information embedded in the XML input stream during unmarshalling. An attacker can craft a specially serialized object (e.g., a TreeSet containing a malicious chain of Java objects) that, when deserialized, triggers the loading and execution of arbitrary code from a remote server. No user is affected who follows the recommended whitelist setup. [1][2]

Exploitation

An attacker with the ability to supply a crafted XML input stream to an XStream deserialization call can achieve remote code execution. No prior authentication or special network position is required. The attack involves replacing the content of a serialized object (e.g., `) with a payload that chains Java classes such as javax.naming.ldap.Rdn$_RdnEntry, com.sun.xml.internal.ws.api.message.Packet, SAAJMessage, and KeyStoreIterator` to ultimately invoke a remote JNDI lookup or load arbitrary bytecode. The specific steps are demonstrated in the XStream advisory by marshaling a simple class and then substituting the resulting XML with the malicious payload before unmarshalling. [2]

Impact

Successful exploitation allows a remote attacker to execute arbitrary code on the target system with the privileges of the running application. This leads to a complete compromise of the application's integrity, availability, and confidentiality—potentially enabling full remote control, data theft, or further lateral movement within the infrastructure. [1][2]

Mitigation

Users should upgrade to XStream version 1.4.18, which no longer uses a blacklist by default—instead shifting to a whitelist model—and is not affected by this vulnerability. As a workaround, users who cannot upgrade must configure XStream's security framework with a strict whitelist of allowed classes. No official patches beyond this version have been issued, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog as of the publication date. [1][2]