CVE-2021-39154: Arbitrary Code Execution in com.thoughtworks.xstream:xstream
Summary
CVE-2021-39154: XStream is vulnerable to an Arbitrary Code Execution attack. Affects com.thoughtworks.xstream:xstream versions < 1.4.18. Fixed in 1.4.18. How to fix ↓
Also tracked for
- libxstream-java · Debian:11
The same CVE-2021-39154 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
com.thoughtworks.xstream:xstream is an open-source library that provides a simple way to serialize objects to XML and back again. It is widely used in Java applications for data serialization and deserialization. However, it is vulnerable to an Arbitrary Code Execution attack, which allows a remote attacker to load and execute arbitrary code from a remote host by manipulating the processed input stream. This vulnerability does not affect users who have followed the recommendation to set up XStream's security framework with a whitelist limited to the minimal required types.
Vulnerability Detail
The vulnerability in com.thoughtworks.xstream:xstream can be exploited by a remote attacker to execute arbitrary code. By manipulating the processed input stream, an attacker can inject malicious code and execute it on the target system. This can lead to various consequences, such as unauthorized access, data theft, or system compromise. XStream 1.4.18 has addressed this vulnerability by no longer using a blacklist by default, as it cannot be secured for general purposes.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.18
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not feasible, XStream provides workarounds for different versions. These workarounds can be found in the XStream documentation, specifically in the 'workarounds' section. Following the recommended workarounds will help mitigate the risk of exploitation.
Conclusion
The vulnerability in com.thoughtworks.xstream:xstream allows remote attackers to execute arbitrary code. It is crucial to update the library to version 1.4.18 or later to mitigate the risk. If updating is not possible, following the provided workarounds is recommended. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
com.thoughtworks.xstream:xstream is an open-source Java library used for object serialization and deserialization to XML.
The vulnerability allows a remote attacker to execute arbitrary code, potentially leading to unauthorized access, data theft, or system compromise.
Updating com.thoughtworks.xstream:xstream to version 1.4.18 or later will fix the vulnerability. Alternatively, you can follow the provided workarounds for different versions.
There are no known exploits for this vulnerability at the moment. However, it is important to patch the vulnerability as soon as possible to prevent potential attacks.
You can find more information about this vulnerability in the XStream documentation for CVE-2021-39154.
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
