CVE-2013-7285: XStream deserialization allows remote OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction, remote command execution impact, and a very high EPSS score with public exploit material make this an urgent fix despite the absence of KEV listing.

What it is

XStream API versions up to 1.4.6 and version 1.4.10, when the security framework has not been initialized, allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream during unmarshaling of XML or other supported formats such as JSON. The flaw is an OS command injection (CWE-78) reachable over the network without authentication, and it affects XStream itself plus products embedding it, including Apache ActiveMQ and Oracle Endeca Information Discovery Studio.

Impact

An attacker gains arbitrary shell command execution on the host running the vulnerable XStream unmarshaling code, which can lead to full compromise of the application and its data. Because the CVSS vector rates confidentiality, integrity and availability all High, the practical outcome is complete loss of control over the affected system.

Attack surface

Reached remotely over the network by submitting a crafted XML or JSON stream to any endpoint that unmarshals untrusted input with a vulnerable XStream version. The CVSS vector shows no privileges and no user interaction required, so any exposed service that deserializes attacker-supplied data is a candidate.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high at 0.84362 (99.7th percentile), and the vendor advisory reference is tagged Exploit, indicating public exploit material exists. No ransomware group is documented as using it.

What to do

• Upgrade XStream to a fixed release beyond 1.4.6 and 1.4.10, and patch or upgrade embedded copies in Apache ActiveMQ and Oracle Endeca Information Discovery Studio per vendor advisories.
• Initialize the XStream security framework and configure an explicit allowlist of permitted classes before unmarshaling any data.
• Never unmarshal untrusted XML or JSON with XStream; treat all external input as hostile and validate or reject it at the boundary.
• Where XStream cannot be removed, isolate the deserializing service with network segmentation and least-privilege process accounts to limit command execution impact.

Detection

• Monitor application and web logs for XStream unmarshaling errors or unexpected class names in submitted XML/JSON payloads.
• Alert on child processes spawned by Java application servers or services that embed XStream, especially shell interpreters such as sh, bash or cmd.exe.
• Search code and dependency inventories for XStream versions up to 1.4.6 and 1.4.10, including shaded copies inside ActiveMQ and Endeca deployments.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.