CVE-2021-21343: Arbitrary File Deletion in com.thoughtworks.xstream:xstream
Summary
CVE-2021-21343: Impact The processed stream at unmarshalling time contains type information to recreate the formerly written objects. Affects com.thoughtworks.xstream:xstream versions < 1.4.16. Fixed in 1.4.16. How to fix ↓
Also tracked for
- activemq · Bitnami
- libxstream-java · Debian:11
The same CVE-2021-21343 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.thoughtworks.xstream:xstream is an open-source library that provides a simple way to serialize and deserialize Java objects to XML and back. It is widely used in various applications and frameworks. However, it is vulnerable to an Arbitrary File Deletion issue when unmarshalling data. This vulnerability allows an attacker to manipulate the input stream and replace or inject objects, resulting in the deletion of a file on the local host. The impact of this vulnerability can be severe if the executing process has sufficient rights.
Vulnerability Detail
The vulnerability arises from the fact that XStream creates new instances of objects based on type information present in the processed input stream. An attacker can exploit this by tampering with the input stream and introducing malicious objects that trigger the deletion of a file on the local host. Users who have not followed the recommended practice of setting up XStream's security framework with a whitelist limited to the minimal required types are affected. However, if the default blacklist of the Security Framework is used, the vulnerability can be mitigated by upgrading to at least version 1.4.16 of XStream.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not feasible, a workaround can be implemented by following the guidelines provided in XStream's documentation for CVE-2021-21343. The documentation provides step-by-step instructions on how to mitigate the vulnerability in different versions of XStream.
Conclusion
CVE-2021-21343 is an Arbitrary File Deletion vulnerability in com.thoughtworks.xstream:xstream. It can be mitigated by upgrading to version 1.4.16 or later. If upgrading is not possible, workarounds are available as described in XStream's documentation. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
The vulnerability allows an attacker to delete files on the local host by manipulating the input stream during unmarshalling. However, users who have followed the recommended security practices are not affected.
The vulnerability can be fixed by upgrading to XStream version 1.4.16 or later. This version includes patches that address the Arbitrary File Deletion issue.
Yes, if upgrading to the latest version is not possible, you can follow the guidelines provided in XStream's documentation for CVE-2021-21343. The documentation offers workarounds for different versions of XStream.
The vulnerability was discovered and reported by 钟潦贵 (Liaogui Zhong) to XStream. They provided the necessary information to reproduce the issue.
For more information, you can open an issue in XStream's GitHub repository or contact the XStream Google Group.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
