CVE-2013-7285: Command Injection in Xstream
Summary
CVE-2013-7285: Command Injection in Xstream. Affects com.thoughtworks.xstream:xstream across 2 version ranges.
< 1.4.7
>= 1.4.10, < 1.4.11
Fixed in 1.4.7 or 1.4.11, depending on the release line you run. How to fix ↓
Also tracked for
- libxstream-java · Debian:11
The same CVE-2013-7285 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Xstream is an API used for serializing Java objects to XML and deserializing XML back into Java objects. It is commonly used in various applications and frameworks. This vulnerability affects Xstream versions up to 1.4.6 and version 1.4.10. The vulnerability allows a remote attacker to execute arbitrary shell commands by manipulating the input stream during the unmarshaling process of XML or any supported format, such as JSON.
Vulnerability Detail
The vulnerability arises when the Xstream security framework has not been initialized. An attacker can exploit this by injecting malicious commands into the processed input stream. This can lead to unauthorized execution of arbitrary shell commands on the target system. The impact of this vulnerability is critical, as it allows an attacker to gain unauthorized access and potentially compromise the entire system.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.4.71.4.7 -
>= 1.4.10, < 1.4.111.4.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version of Xstream is not immediately feasible, a temporary workaround is to ensure that the Xstream security framework is properly initialized before unmarshaling any XML or supported format. This can be done by explicitly calling the appropriate initialization methods in your code. Here is an example of how to initialize the security framework:
import com.thoughtworks.xstream.XStream;
import com.thoughtworks.xstream.security.NullPermission;
XStream xstream = new XStream();
xstream.addPermission(NullPermission.NULL);
By explicitly adding the NullPermission, you prevent the execution of arbitrary shell commands during unmarshaling.
Conclusion
In conclusion, the Xstream API versions up to 1.4.6 and version 1.4.10 are vulnerable to command injection. This can be exploited by manipulating the input stream during unmarshaling, allowing remote attackers to execute arbitrary shell commands. It is crucial to upgrade to a fixed version of Xstream or apply the provided workaround to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
Xstream is an API used for serializing Java objects to XML and deserializing XML back into Java objects. It is widely used in various applications and frameworks.
Xstream versions up to 1.4.6 and version 1.4.10 are affected by this vulnerability.
The impact of this vulnerability is critical. It allows a remote attacker to execute arbitrary shell commands on the target system, potentially gaining unauthorized access and compromising the entire system.
To fix this vulnerability, upgrade to Xstream version 1.4.6 or later. Update the Xstream dependency in your project's Maven configuration file (pom.xml) and rebuild your application.
Yes, if upgrading to a fixed version is not immediately feasible, you can initialize the Xstream security framework explicitly in your code to prevent command injection. See the 'workaround' section for an example.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.