CVE-2013-7285
Critical · 9.8CVSS
9.8
EPSS
84.4%
Published
May 15, 2019
CISA due date
—
The record
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.thoughtworks.xstream:xstream | 0 | 1.4.7 |
| Maven | com.thoughtworks.xstream:xstream | 1.4.10 | 1.4.11 |
| Debian:11 | libxstream-java | 0 | 1.4.7-1 |
| Debian:12 | libxstream-java | 0 | 1.4.7-1 |
| Debian:13 | libxstream-java | 0 | 1.4.7-1 |
| Mageia:3 | xstream | 0 | 1.3.1-6.1.mga3 |
| Mageia:4 | kxml | 0 | 2.3.0-5.1.mga4 |
| Mageia:4 | xstream | 0 | 1.4.7-1.mga4 |
| Red Hat:rhev_manager:3 | jasperreports-server-pro | 0 | 0:5.5.0-6.el6ev |
| Ubuntu:14.04:LTS | libxstream-java | 0 | 1.4.7-1 |
Related vulnerabilities
- CVE-2024-47072 XStream is a simple library to serialize objects to XML and back again. Also affects com.thoughtworks.xstream:xstream
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113726 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113725 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113722 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-112943 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-78