CVE-2021-21343: XStream XML deserialization allows arbitrary file deletion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityNetwork-reachable, no authentication or interaction required, high EPSS, and public exploit detail, though impact is limited to file deletion and KEV listing is absent.

What it is

XStream before 1.4.16 unmarshals attacker-controlled XML that carries type information, letting the attacker replace or inject objects during deserialization. The injected object graph can delete a file on the local host. Systems relying on XStream's default blacklist rather than a minimal whitelist are exposed.

Impact

An attacker can cause deletion of an arbitrary file on the host running the vulnerable XStream instance, which can disrupt or break the affected application or service. The CVSS vector shows high integrity impact with no confidentiality or availability scoring, though file deletion can indirectly affect availability.

Attack surface

Reached by supplying a crafted XML stream to an application that unmarshals untrusted data with XStream. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network reachability with no authentication and no user interaction required.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented. EPSS is high (0.46666, 98.8th percentile) and the vendor advisory reference is tagged Exploit, indicating public exploit detail exists.

What to do

• Upgrade XStream to 1.4.16 or later, which fixes the default blacklist behavior.
• Replace reliance on the default blacklist with a whitelist limited to the minimal required types.
• Apply vendor patches for products bundling XStream (Apache ActiveMQ, JMeter, NetApp, Oracle, Debian, Fedora) as listed in their advisories.
• Do not unmarshal XML from untrusted or unauthenticated sources; restrict network exposure of endpoints that deserialize XML.
• Review the XStream security framework workaround guidance referenced in the vendor advisory.

Detection

• Monitor application logs for XStream unmarshalling errors or unexpected class instantiation during XML processing.
• Alert on file deletion events (especially unexpected or sensitive paths) on hosts running XStream-based services.
• Inspect inbound XML payloads for type information and class names not expected by the application.
• Track XStream library versions in deployed applications and flag instances below 1.4.16.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.