CVE-2013-7285
Command Injection in Xstream
CVE-2013-7285 is a critical vulnerability (CVSS 9.8) in Xstream, published February 25, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 84.4%, the 99th percentile. Fixed in com.thoughtworks.xstream:xstream 1.4.7.
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
- Record
CVE-2013-7285- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-78
- Updated
- 2026-11-02
CVE List No score
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
- Record
CVE-2013-7285- Updated
- 2026-11-02
EUVDEUVD-2019-0463 No score
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
- Record
EUVD-2019-0463- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-f554-x222-wgf7
Command Injection in Xstream
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
- Record
GHSA-f554-x222-wgf7- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77, CWE-78
- Updated
- 2026-11-02
OSV
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
- Record
CVE-2013-7285- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-7285
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
- Record
DEBIAN-CVE-2013-7285- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-f554-x222-wgf7
Command Injection in Xstream
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
- Record
GHSA-f554-x222-wgf7- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77, CWE-78
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-7285
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
- Record
UBUNTU-CVE-2013-7285- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2014-0100 No score
Updated xstream packages fix CVE-2013-7285
Updated xstream packages fix security vulnerability:
It was found that XStream would deserialize arbitrary user-supplied XML content, representing objects of any type. A remote attacker able to pass XML to XStream could use this flaw to perform a variety of attacks, including remote code execution in the context of the server running the XStream application (CVE-2013-7285).
- Record
MGASA-2014-0100- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.thoughtworks.xstream:xstreamMaven |
before 1.4.7 | 1.4.7 |
com.thoughtworks.xstream:xstreamMaven |
1.4.10 to 1.4.10 | 1.4.11 |
libxstream-javaDebian:12 |
before 1.4.7-1 | 1.4.7-1 |
libxstream-javaDebian:13 |
before 1.4.7-1 | 1.4.7-1 |
libxstream-javaDebian:14 |
before 1.4.7-1 | 1.4.7-1 |
com.thoughtworks.xstream:xstreamMaven |
before 1.4.7, plus listed versions 0.10.20.30.50.6 Show 19 moreShow less1.01.0.11.0.21.11.1.11.1.21.1.31.21.2.11.2.21.31.3.11.41.4.11.4.21.4.31.4.41.4.51.4.6 |
1.4.7 |
com.thoughtworks.xstream:xstreamMaven |
1.4.10 up to 1.4.11, plus listed versions 1.4.10-java7 |
1.4.11 |
xstreamMageia:3 |
before 1.3.1-6.1.mga3 | 1.3.1-6.1.mga3 |
kxmlMageia:4 |
before 2.3.0-5.1.mga4 | 2.3.0-5.1.mga4 |
xstreamMageia:4 |
before 1.4.7-1.mga4 | 1.4.7-1.mga4 |
jasperreports-server-proRed Hat:rhev_manager:3 |
before 0:5.5.0-6.el6ev | 0:5.5.0-6.el6ev |
libxstream-javaUbuntu:14.04:LTS |
before 1.4.7-1, plus listed versions 1.4.4-1 |
1.4.7-1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | OpenMRS Reporting Module 0.9.7 - Remote Code Execution | 2016-01-07 |
| Nuclei | XStream <1.4.6/1.4.10 - Remote Code Execution | |
| PoC in GitHub | shoucheng3/x-stream__xstream_CVE-2013-7285_1-4-6 | 2025-08-19 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
References
seclists.org/oss-sec/2014/q1/69
mail-archive.com/user%40xstream.codehaus.org/msg00604.html
lists.apache.org/thread.html/dcf8599b80e43a6b60482607adb76c64672772dc2d9209ae2170f369%40%3Cissues.activemq.apache.org%3E
blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
Show 25 moreShow less
x-stream.github.io/CVE-2013-7285.html
oracle.com/security-alerts/cpuoct2020.html
web.archive.org/web/20140204133306/http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
nvd.nist.gov/vuln/detail/CVE-2013-7285
github.com/x-stream/xstream/commit/6344867dce6767af7d0fe34fb393271a6456672d
security-tracker.debian.org/tracker/CVE-2013-7285
advisories.mageia.org/MGASA-2014-0100.html
xstream.codehaus.org/security.html
lists.fedoraproject.org/pipermail/package-announce/2014-February/128807.html
bugs.mageia.org/show_bug.cgi?id=12874
access.redhat.com/errata/RHSA-2014:0389
bugzilla.redhat.com/show_bug.cgi?id=1051277
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0389.json
cve.org/CVERecord?id=CVE-2013-7285
securityblog.redhat.com/2014/01/23/java-deserialization-flaws-part-2-xml-deserialization
ubuntu.com/security/CVE-2013-7285
markmail.org/message/kfqoqdfj5fnup5co?q=list:org.codehaus.xstream.dev&page=3
fisheye.codehaus.org/changelog/xstream?cs=2210