Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕ Maven

GHSA-7chv-rrw6-w6fc

HIGH

XStream is vulnerable to a Remote Command Execution attack

Also known asCVE-2021-29505
Published
May 18, 2021
Updated
Mar 13, 2026
Affected
1 pkg
Patched
1 / 1
Exploits
2 known

EPSS Exploitation Probability

via FIRST.org ↗
90.3%probability of exploitation in next 30 days
Very High Risk100th percentile0.00%
89.8%90.3%90.8%91.3%90.3%90.3%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

1 pkg affected
☕com.thoughtworks.xstream:xstream

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

Patches

If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.17.

Workarounds

See workarounds for the different versions covering all CVEs.

References

See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for CVE-2021-29505.

Credits

V3geB1rd, white hat hacker from Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.

For more information

If you have any questions or comments about this advisory:

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
☕Mavencom.thoughtworks.xstream:xstreamall versions1.4.17
Exploits & PoCs
2

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

XStream is software for serializing Java objects to XML and back again. …

github.comGithubJun 2021

Frequently Asked Questions

### Impact The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. ### Patches If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.17. ### Workarounds See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs. ### References See full infor
O3 Security · Impact-Aware SCA

Is GHSA-7chv-rrw6-w6fc in your stack?

O3 detects GHSA-7chv-rrw6-w6fc across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my stack How O3 SCA works