xstream — Vulnerabilities & Security Advisories 3

Xstream is a Java library for serializing objects to XML and deserializing XML back to objects, commonly used for data exchange in enterprise applications. Historically, it has been vulnerable to remote code execution (RCE) due to unsafe deserialization of untrusted input, with three CVEs recorded. The library's default configuration allows processing of arbitrary types, enabling attackers to execute malicious code through crafted XML payloads. Notable security characteristics include its permissive type handling and lack of built-in input validation, making it a frequent target in supply chain attacks. Organizations using xstream should implement strict input validation and consider alternative serialization libraries with stronger security controls.