CVE-2021-39147: XStream Arbitrary Code Execution Vulnerability
Summary
CVE-2021-39147: XStream is vulnerable to an Arbitrary Code Execution attack. Affects com.thoughtworks.xstream:xstream versions < 1.4.18. Fixed in 1.4.18. How to fix ↓
Also tracked for
- libxstream-java · Debian:11
The same CVE-2021-39147 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is an open-source Java library that provides a simple way to serialize objects to XML and back again. It is widely used in various applications and frameworks for data serialization. However, XStream is vulnerable to an Arbitrary Code Execution attack, which allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. This vulnerability can have severe consequences if not addressed.
Vulnerability Detail
The vulnerability in XStream arises from its processing of input streams. By manipulating the input stream, a remote attacker can inject and execute arbitrary code on the target system. This can lead to unauthorized access, data breaches, and other malicious activities. It is important to note that users who have followed the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types are not affected by this vulnerability.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, XStream provides workarounds for different versions covering all CVEs. These workarounds can be found in the XStream documentation at https://x-stream.github.io/security.html#workaround.
Conclusion
The XStream Arbitrary Code Execution vulnerability (CVE-2021-39147) poses a significant risk to systems using XStream for object serialization. It is crucial to update to XStream version 1.4.18 or later to mitigate this vulnerability. Alternatively, follow the provided workarounds until the update can be applied. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
XStream is an open-source Java library used for object serialization to XML and deserialization from XML back to objects.
The vulnerability allows a remote attacker to execute arbitrary code on the target system, potentially leading to unauthorized access and data breaches.
The vulnerability was discovered and reported by wh1t3p1g from TSRC (Tencent Security Response Center).
To fix this vulnerability, update XStream to version 1.4.18 or later. Alternatively, follow the provided workarounds for different versions.
Yes, the CVSS score for this vulnerability is 8.5, indicating a high severity.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
