Remote code execution via injected object types

Unsafe deserialization in XStream 1.4.17 and earlier allows remote attackers to execute arbitrary code through a manipulated input stream. During fromXML unmarshalling, attacker-supplied type metadata makes XStream instantiate injected objects that fetch and execute code from a remote server. The attack requires an application to pass attacker-controlled data to an instance using the default blacklist; an explicit minimal-type allowlist blocks it.