CVE-2021-21345 Scanner
Detects 'Remote Code Execution (RCE)' vulnerability in Xstream affects v. before 1.4.16.
Used 2.4k times · 3.3k assets checked · domain, ipv4, subdomain
CVE
CVE-2021-21345
9.9
CVSSmedium
Exploitable remotely over the internet · low-privilege account sufficient · user interaction needed.
Description
XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
Attack Vector
Network
Privileges Req.
Low
User Interaction
Required
xstream
Updated Oct 12, 2026View on NVD →
S4E scanner
CVE history: xstream
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →