CVE-2021-39151: Arbitrary Code Execution in com.thoughtworks.xstream:xstream
Summary
CVE-2021-39151: XStream is vulnerable to an Arbitrary Code Execution attack. Affects com.thoughtworks.xstream:xstream versions < 1.4.18. Fixed in 1.4.18. How to fix ↓
Also tracked for
- libxstream-java · Debian:11
The same CVE-2021-39151 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
com.thoughtworks.xstream:xstream is an open-source library used for serialization and deserialization of Java objects to XML and vice versa. It provides a simple API for converting objects to XML and XML to objects. However, a vulnerability has been discovered in XStream that allows remote attackers to execute arbitrary code by manipulating the input stream. This vulnerability can be mitigated by setting up XStream's security framework with a whitelist limited to the minimal required types.
Vulnerability Detail
The vulnerability in XStream arises from the lack of proper input validation and processing. By manipulating the input stream, a remote attacker can inject and execute arbitrary code on the target system. This can lead to various security risks, including unauthorized access, data leakage, and remote code execution. XStream 1.4.18 has addressed this vulnerability by no longer using a blacklist by default.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not feasible, a workaround can be implemented by following the steps provided in XStream's documentation for CVE-2021-39151. The workaround involves configuring XStream's security framework with a whitelist that includes only the required types and disabling the use of external entity resolution.
Conclusion
The vulnerability in com.thoughtworks.xstream:xstream allows remote attackers to execute arbitrary code by manipulating the input stream. It is crucial to update to version 1.4.18 or later and configure XStream's security framework properly. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
com.thoughtworks.xstream:xstream is an open-source library used for serialization and deserialization of Java objects to XML and vice versa. It provides a simple API for converting objects to XML and XML to objects.
The vulnerability allows remote attackers to execute arbitrary code on the target system by manipulating the input stream. This can lead to unauthorized access, data leakage, and remote code execution.
To fix this vulnerability, update the com.thoughtworks.xstream:xstream package to version 1.4.18 or later and configure XStream's security framework with a whitelist limited to the necessary types.
Yes, if updating to the latest version is not possible, you can follow the workaround steps provided in XStream's documentation for CVE-2021-39151. This involves configuring XStream's security framework with a whitelist and disabling external entity resolution.
The vulnerability was discovered and reported by Smi1e of DBAPPSecurity WEBIN Lab. They provided the necessary information to reproduce the issue.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
