CVE-2021-21351: XStream Arbitrary Code Execution
Summary
CVE-2021-21351: XStream is vulnerable to an Arbitrary Code Execution attack. Affects com.thoughtworks.xstream:xstream versions < 1.4.16. Fixed in 1.4.16. How to fix ↓
Also tracked for
- activemq · Bitnami
- libxstream-java · Debian:11
The same CVE-2021-21351 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is an open-source Java library used for serializing objects to XML and deserializing XML back into objects. It provides a simple API for converting Java objects to XML and vice versa. XStream is widely used in various applications and frameworks for data serialization and deserialization purposes.
Vulnerability Detail
The vulnerability in XStream allows a remote attacker to execute arbitrary code by manipulating the processed input stream. This can be achieved by exploiting a flaw in the library's security framework. If the security framework is not properly configured with a whitelist of allowed types, an attacker can inject malicious code and execute it on the target system. Users who have followed the recommendation to set up XStream's security framework with a limited whitelist are not affected.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, there are workarounds available for different versions of XStream. These workarounds are documented in XStream's security advisory and provide steps to mitigate the vulnerability until the library can be updated.
Conclusion
The vulnerability in XStream allows remote code execution if the library's security framework is not properly configured. It is crucial to update XStream to version 1.4.16 or apply the provided workarounds to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
XStream is a Java library used for serializing and deserializing objects to XML. It provides a convenient way to convert Java objects to XML and vice versa.
The vulnerability allows a remote attacker to execute arbitrary code on the target system by manipulating the input stream. However, users who have properly configured XStream's security framework with a whitelist are not affected.
To fix this vulnerability, update XStream to version 1.4.16 or later. This version includes patches that address the security issue.
Yes, if updating to the latest version is not immediately feasible, there are workarounds documented in XStream's security advisory. These workarounds provide steps to mitigate the vulnerability until the library can be updated.
The vulnerability was discovered by wh1t3p1g G5-RD6@IIE, who reported it to XStream and provided the necessary information to reproduce the issue.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
