cve: NONE
alias: Hardened XStream binder
cwe_primary: NONE
cwe_acceptable: []
target_file: source.java
vuln_lines: []
severity: none
vuln_class: clean
exploit_pattern_regex: ''
must_mention_any: []
points: 0
notes: |
  Intentionally NOT vulnerable. XStream is configured with NoTypePermission.NONE
  baseline plus an explicit class allowlist. fromXML on attacker XML cannot
  instantiate ProcessBuilder or other RCE gadgets.
  Reporting a vulnerability here = false positive.