CVE-2021-29505

HighPublished

XStream is vulnerable to a Remote Command Execution attack

Published: May 28, 2021
Updated: Oct 7, 2026
Assigning CNA: GitHub_M
Evidence observed: Aug 8, 2026

Primary CVSS

8.8/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

77.2%

High · next 30 days

Percentile: 99.6%
Model date: Oct 17, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.

Sources

Repository evidence: Files: 2 · Repositories: 2

1 Template1 Lab

XStream Deserialization Command ExecutionLab
xstream/CVE-2021-29505
XStream Deserialization Remote Command Execution (CVE-2021-29505)
Vulhub vulnerability labs
ResearchEvidence observed: Sep 25, 2026Revision: 9b90d4276f84Related tool
Declared conditions
- lab image version: vulhub/xstream:1.4.16(xstream/CVE-2021-29505/docker-compose.yml:services.web.image)
XStream <1.4.17 - Remote Code ExecutionTemplate
http/cves/2021/CVE-2021-29505.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: 17f5725dc10cRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)
- oob: interactsh_reference($.template_text)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.