CVE-2021-29505 - CVE House

Back to Database

Status published High CVE-2021-29505

XStream is vulnerable to a Remote Command Execution attack

7.5 CVSS

Vulnerability Description

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-29505

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from x-stream

View All →

XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream

XStream Denial of Service via stack overflow

Denial of Service by injecting highly recursive collections or maps in XStream

XStream is vulnerable to an Arbitrary Code Execution attack

XStream is vulnerable to an Arbitrary Code Execution attack

Affected Vendor

x-stream

View all reports →

Affected Software

xstream

Vulnerable Versions:

< 1.4.17

Timeline

Official Publish: May 28th, 2021

Last Modified: May 29th, 2025

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1505.003 Web Shell

T1105 Ingress Tool Transfer

Command and Control

T1565.002 Stored Data Manipulation

T1068 Exploitation for Privilege Escalation

Privilege Escalation