Deserialization of Untrusted Data and Code Injection in xstream (CVE-2019-10173)

Deserialization of Untrusted Data and Code Injection in xstream (CVE-2019-10173) | HOL Guard CVE

Why this deserves its current priority

CVSS is 9.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps com.thoughtworks.xstream:xstream (maven). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
com.thoughtworks.xstream:xstreammaven	>=1.4.10 <1.4.11	1.4.11

Recommended response

Check inventory. Check lockfiles and deployed manifests for com.thoughtworks.xstream:xstream.
Review the reported fix. Update com.thoughtworks.xstream:xstream to 1.4.11 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jul 26, 2019
Evidence: source:osv:source_dates:source-dates:record
Source modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:record
First seen by HOL
Sep 10, 2026

Sources and claim methodology

Upstream source description

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)

Quoted source text, attributed separately from HOL analysis.