XStream XML Deserialization Remote Code Execution Vulnerability (CVE-2021-39144) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTJava applications utilizing XStream library versions prior to 1.4.18, and third-party solutions like VMware NSX Manager embedding this library
Unauthenticated remote attackers can execute arbitrary system commands on the host by manipulating the processed XML input stream
Upgrade XStream to version 1.4.18 or higher, and configure XStream's security framework with a strict whitelist
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Force-upgrade the XStream dependency to a secure version (1.4.18 or higher) in your project's build configuration.
For Maven (pom.xml):
<dependency>
<groupId>com.thoughtworks.xstream</groupId>
<artifactId>xstream</artifactId>
<version>1.4.18</version>
</dependency>For Gradle (build.gradle):
implementation 'com.thoughtworks.xstream:xstream:1.4.18'2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, configure XStream's security framework to enforce a strict whitelist, allowing only explicitly trusted classes to be deserialized.
Java Implementation Example:
XStream xstream = new XStream();
// Clear all default permissions
xstream.addPermission(NoTypePermission.NONE);
// Explicitly allow only minimal required safe classes
xstream.allowTypes(new Class { java.util.ArrayList.class, com.example.dto.MySafeDto.class });3. Log Audit & IoC Verification Commands
Scan the system for vulnerable XStream JAR files and inspect application logs for potential deserialization exploit attempts.
# Search for vulnerable xstream jar files on the system
find / -name 'xstream-*.jar' 2>/dev/null
# Scan application logs for common deserialization gadgets and execution keywords
grep -riE '(java.lang.ProcessBuilder|Runtime.getRuntime|DynamicProxy)' /var/log/apps/Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2021-39144) is a critical deserialization flaw in XStream, a popular open-source Java library used to serialize objects to XML and back. XStream, by default, does not sufficiently validate or restrict the types of objects being reconstructed during the deserialization process. Prior to version 1.4.18, XStream relied on a blacklist-based approach, which proved insufficient to block sophisticated, nested malicious object graphs. Consequently, processing untrusted XML input allows attackers to instantiate arbitrary classes, leading to remote code execution.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious XML payload containing serialized Java objects (such as dynamic proxies or specific gadget chains) and transmits it via an HTTP request or input stream processed by XStream. When XStream deserializes this payload, it triggers implicit method invocations (e.g., hashCode, equals, or compare) on the reconstructed objects, executing arbitrary system commands (e.g., via Runtime.getRuntime().exec()). This vulnerability has been actively exploited in the wild, notably targeting enterprise solutions like VMware NSX Manager that embed vulnerable XStream components.
3. Infrastructure & Business Impact
As a CISA KEV-listed vulnerability with an EPSS score exceeding 0.98, this flaw represents an immediate threat. Successful exploitation grants the attacker full system-level privileges on the host, enabling lateral movement, sensitive data exfiltration, ransomware deployment, or persistent backdoor installation. This poses a severe risk to business continuity and infrastructure integrity.
Official Vendor Advisories & References
XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
Frequently Asked SecOps Questions (CVE-2021-39144)
FAQQ1. How critical is CVE-2021-39144 and is it actively exploited in the wild?
CVE-2021-39144 is rated CVSS 8.5 (HIGH) with a 30-day EPSS exploitation probability of 98.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2021-39144?
Primary impacted vendors include xstream, vmware across xstream, nsx-manager. Scope summary: All XStream versions prior to 1.4.18, including third-party products (such as VMware NSX Manager) that bundle vulnerable versions of the library
Q3. What temporary mitigations or workarounds exist for CVE-2021-39144 before patching?
[Mitigation] Upgrade XStream to version 1.4.18 or higher, and configure XStream's security framework with a strict whitelist Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2021-39144
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (xstream)
View Category →Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
VeloCloud Orchestrator (VCO) Privilege Escalation and Internal Access Vulnerability (CVE-2026-114625)
[Affected Scope] On-premise deployments of VeloCloud Orchestrator (VCO).
VMware vCenter Server Syslog Service Directory Traversal Remote Code Execution Vulnerability (CVE-2026-59310)
[Affected Scope] Systems running VMware vCenter Server with the built-in Syslog server service enabled.
VMware Aria Operations Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-22719)
[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.