Authenticated remote code execution via unsafe unmarshalling

XStream before 1.4.16 allows remote authenticated users to execute arbitrary code by supplying manipulated serialized input to Java object unmarshalling. During unmarshalling, attacker-controlled type metadata causes XStream to instantiate injected classes and resolve a remote object payload; the documented proof of concept uses XML, and other supported formats can be abused similarly. Exploitation requires access to an application that passes attacker-controlled data to XStream with its pre-1.4.16 blacklist-based security configuration; a minimal whitelist blocks the injected types.