[aikido-autofix]

Thank you for submitting a pull request to the WebGoat!

---

Summary / Description

Upgrade dependencies to fix critical RCE and arbitrary code execution vulnerabilities in XStream, Tomcat, Spring Security, and Jackson.

---

Security Impact — CVE vulnerabilities fixed by this PR

✅ 47 CVEs resolved by this upgrade, including 15 critical 🚨 CVEs

This PR will resolve the following CVEs:

Issue	Severity	Description
CVE-2021-21345	🚨 CRITICAL	[xstream] A deserialization vulnerability allows remote attackers with sufficient rights to execute arbitrary commands by manipulating input streams. This impacts users relying on the default blacklist security framework rather than implementing a whitelist.
CVE-2013-7285	🚨 CRITICAL	[xstream] API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
CVE-2021-21344	🚨 CRITICAL	[xstream] A remote code execution vulnerability allows attackers to execute arbitrary code by manipulating input streams, bypassing the default blacklist security framework. Users relying on default security settings must upgrade to mitigate this risk.
CVE-2021-21346	🚨 CRITICAL	[xstream] A remote code execution vulnerability allows attackers to execute arbitrary code by manipulating input streams, bypassing the default blacklist security framework. Users relying on default security settings must upgrade to mitigate this risk.
CVE-2021-21347	🚨 CRITICAL	[xstream] A remote code execution vulnerability allows attackers to execute arbitrary code by manipulating input streams, bypassing the default blacklist security framework. Users relying on default security settings must upgrade to mitigate this risk.
CVE-2021-21350	🚨 CRITICAL	[xstream] Deserialization vulnerability allowing remote code execution through malicious XML input when using default blacklist security settings instead of a whitelist configuration.
CVE-2021-21342	🚨 CRITICAL	[xstream] Deserialization vulnerability allowing attackers to manipulate XML input streams to inject malicious objects, potentially causing server-side request forgery (SSRF) attacks during unmarshalling operations. Default blacklist configurations are vulnerable; whitelist-based security frameworks are unaffected.
CVE-2021-21351	🚨 CRITICAL	[xstream] Deserialization vulnerability allowing remote code execution through malicious XML input when using default blacklist security settings instead of a whitelist configuration.
CVE-2021-39144	🚨 CRITICAL	[xstream] A deserialization vulnerability allows remote attackers with sufficient rights to execute arbitrary commands by manipulating input streams. Users not using XStream's security framework with a whitelist are at risk.
CVE-2020-26217	HIGH	[xstream] A remote code execution vulnerability allows attackers to execute arbitrary shell commands by manipulating input streams when using blocklists. Users relying on allowlists are unaffected.
CVE-2021-29505	HIGH	[xstream] A deserialization vulnerability allows remote attackers to execute arbitrary commands on the host by manipulating input streams when security restrictions are not properly configured. Users with whitelisted type restrictions are not affected.
CVE-2021-21349	HIGH	[xstream] A vulnerability allows remote attackers to access internal resources by manipulating input streams, bypassing the default blacklist security framework. This enables information disclosure of non-public data when using default security settings.
CVE-2021-39141	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39146	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39152	HIGH	[xstream] A deserialization vulnerability allows remote attackers to access internal resources by manipulating input streams on Java 14-8 runtimes. This information disclosure issue bypasses the default blacklist security framework.
CVE-2021-39139	HIGH	[xstream] Deserialization vulnerability allowing remote code execution through malicious XML input when using default settings without security framework restrictions.
CVE-2020-26258	HIGH	[xstream] A Server-Side Request Forgery (SSRF) vulnerability in XStream's unmarshalling process allows remote attackers to access internal resources by manipulating input streams when using the default blacklist security configuration.
CVE-2017-7957	HIGH	[xstream] through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("") call.
CVE-2021-21341	HIGH	[xstream] A vulnerability allows remote attackers to cause denial of service by manipulating input streams to consume 100% CPU resources. This affects systems using default blacklist security settings; whitelist-based configurations are unaffected.
CVE-2022-41966	HIGH	[xstream] A remote attacker can manipulate input streams to trigger recursive hash calculations in collections, causing stack overflow and denial of service. The vulnerability exploits hash code implementations in maps and collections to crash the application.
CVE-2016-3674	HIGH	[xstream] Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
CVE-2021-39145	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39147	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39148	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39149	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39150	HIGH	[xstream] A deserialization vulnerability allows remote attackers to access internal resources by manipulating input streams on Java 14-8 runtimes. This information disclosure issue bypasses the default blacklist security framework.
CVE-2021-39151	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-39153	HIGH	[xstream] A deserialization vulnerability allows remote attackers to execute arbitrary code by manipulating input streams when using Java 14-8 or with JavaFX installed, unless XStream's security whitelist is properly configured.
CVE-2021-39154	HIGH	[xstream] Remote attackers can execute arbitrary code by manipulating input streams through unsafe deserialization. This vulnerability allows RCE unless XStream's security framework is configured with a strict whitelist of allowed types.
CVE-2021-21343	HIGH	[xstream] Deserialization vulnerability allowing arbitrary object instantiation during unmarshalling, enabling attackers to manipulate input streams and delete files on the local system through malicious type information injection.
CVE-2021-21348	HIGH	[xstream] Denial of Service vulnerability allowing remote attackers to consume maximum CPU resources through a malicious serialized object, causing thread hang. Affects systems using default blacklist security configuration.
CVE-2020-26259	MEDIUM	[xstream] XStream is vulnerable to arbitrary file deletion on the local host during unmarshalling when using default blacklist security settings. A remote attacker can delete arbitrary files if the executing process has sufficient permissions.
CVE-2022-40151	MEDIUM	[xstream] Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow. This effect may support a denial of service attack.
CVE-2021-39140	MEDIUM	[xstream] A vulnerability allows remote attackers to cause denial of service by manipulating input streams to consume 100% CPU resources. This affects systems not using XStream's security framework with a whitelist of minimal required types.
CVE-2021-43859	LOW	[xstream] Deserialization vulnerability allowing remote attackers to cause denial of service by consuming 100% CPU through malicious input stream manipulation. Fixed by implementing time-based threshold monitoring for collection operations.
CVE-2026-41293	🚨 CRITICAL	[tomcat-embed-core] Improper input validation vulnerability allows attackers to bypass security controls or trigger unexpected behavior. Potential impacts include remote code execution, denial of service, or information disclosure depending on exploitation context.
CVE-2026-43512	🚨 CRITICAL	[tomcat-embed-core] Digest authentication bypass vulnerability allowing attackers to bypass authentication mechanisms and gain unauthorized access to protected resources.
CVE-2026-43515	🚨 CRITICAL	[tomcat-embed-core] Improper authorization in method constraints allows attackers to bypass HTTP method restrictions on specific file extensions, potentially enabling unauthorized access to protected resources.
CVE-2026-24880	HIGH	[tomcat-embed-core] HTTP request smuggling vulnerability via invalid chunk extensions allows attackers to bypass security controls and potentially execute arbitrary code or manipulate request handling.
CVE-2026-25854	MEDIUM	[tomcat-embed-core] Open redirect vulnerability in LoadBalancerDrainingValve allows attackers to redirect users to untrusted sites. This could enable phishing attacks or malicious redirects to compromise user security.
CVE-2025-61795	MEDIUM	[tomcat-embed-core] Temporary files from multipart uploads aren't cleaned up immediately during errors, allowing disk space to fill faster than garbage collection clears it, causing denial of service.
CVE-2026-22732	🚨 CRITICAL	[spring-security-core] HTTP response security headers may not be written to responses in servlet applications using lazy header writing, potentially allowing security headers to be bypassed and exposing applications to attacks that these headers would normally prevent.
CVE-2026-40477	🚨 CRITICAL	[thymeleaf-spring5] Server-Side Template Injection (SSTI) vulnerability allowing attackers to bypass expression restrictions and access sensitive objects through unvalidated user input. An unauthenticated remote attacker can execute arbitrary code on the server.
CVE-2026-41901	🚨 CRITICAL	[thymeleaf-spring5] Server-Side Template Injection (SSTI) vulnerability in sandboxed expression contexts allows attackers to execute arbitrary code when unsanitized user input is processed in restricted template contexts.
CVE-2026-40478	HIGH	[thymeleaf-spring5] Server-Side Template Injection (SSTI) vulnerability allowing attackers to bypass expression execution protections and execute unauthorized code through unvalidated user input. Remote code execution is possible when user input is passed directly to the template engine.
CVE-2026-54512	HIGH	[jackson-databind] Polymorphic type validator bypass allows attackers to deserialize denied classes by hiding them as generic type parameters within allowed container types. This enables remote code execution through instantiation and property population of malicious gadget classes.
CVE-2026-54513	HIGH	[jackson-databind] BasicPolymorphicTypeValidator's allowIfSubTypeIsArray() method fails to validate array component types against the allowlist, allowing deserialization of non-allowlisted types as array elements. This bypasses type validation and enables remote code execution through malicious object instantiation.

---

Breaking Changes & Upgrade Impact — prefer Warnings / Cautions / ⚠️ sections over implementation sections (upgrade risks, breaking changes, manual migration steps)

⚠️ Breaking changes analysis not available for: com.thoughtworks.xstream:xstream, com.fasterxml.jackson.core:jackson-databind

✅ No breaking changes for: org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-coyote, org.apache.tomcat:tomcat-catalina, org.apache.tomcat:tomcat-util, org.apache.tomcat.embed:tomcat-embed-websocket, org.springframework.security:spring-security-core, org.springframework.security:spring-security-config, org.springframework.security:spring-security-web, org.thymeleaf:thymeleaf-spring5, org.thymeleaf:thymeleaf-spring6, org.thymeleaf:thymeleaf

---

Fix Details / Technical Implementation (detailed write-up of what was changed and why)

🤖 Remediation details

Fix critical and high security vulnerabilities in XStream, Tomcat, Spring Security, Thymeleaf, and jackson-databind

Short summary

This PR remediates security vulnerabilities in the following packages declared or resolved in the root pom.xml: com.thoughtworks.xstream:xstream (direct dependency), and the transitively resolved org.apache.tomcat.embed:tomcat-embed-core, org.apache.tomcat:tomcat-*, org.springframework.security:spring-security-*, org.thymeleaf:thymeleaf / thymeleaf-spring6, and com.fasterxml.jackson.core:jackson-databind. Three edits were made to pom.xml: the spring-boot-starter-parent version was bumped, the xstream.version property was updated, and a jackson-bom.version property override was added. A previously declared thymeleaf.version property override that was pinning Thymeleaf below the patched floor was also removed.

com.thoughtworks.xstream:xstream

xstream is a direct dependency whose version is controlled by the xstream.version property in pom.xml. The property was updated from 1.4.5 to 1.4.20 to satisfy the patched floor of 1.4.20 required across the full set of XStream advisories (ranging from CVE-2013-7285 through CVE-2022-41966). Version 1.4.5 was vulnerable to every listed XStream advisory; 1.4.20 is the smallest release that clears all of them.

org.apache.tomcat.embed:tomcat-embed-core / org.apache.tomcat:tomcat-*

These Tomcat artifacts are transitive dependencies managed entirely by the spring-boot-starter-parent BOM via its tomcat.version property. Bumping the parent from 3.5.6 to 3.5.16 advances tomcat.version from 10.1.46 to 10.1.55, which is the patched floor required for the Tomcat advisories (CVE-2026-41293, CVE-2026-43512, CVE-2026-43515, CVE-2026-24880, CVE-2026-25854, CVE-2025-61795). No direct declaration or dependencyManagement override was needed.

org.springframework.security:spring-security-core / spring-security-config / spring-security-web

These Spring Security artifacts are transitive dependencies managed by the spring-boot-starter-parent BOM via its spring-security.version property. The parent bump from 3.5.6 to 3.5.16 advances spring-security.version from 6.5.5 to 6.5.11, which exceeds the patched floor of 6.5.9 required for CVE-2026-22732. No additional override was needed.

org.thymeleaf:thymeleaf / thymeleaf-spring6

Thymeleaf is a transitive dependency managed by the spring-boot-starter-parent BOM via its thymeleaf.version property. The root pom.xml had a local <thymeleaf.version>3.1.2.RELEASE</thymeleaf.version> property that overrode the parent's managed version, pinning Thymeleaf below the patched floor of 3.1.4.RELEASE required for CVE-2026-40477, CVE-2026-41901, and CVE-2026-40478. That local property was removed so the parent's value (3.1.5.RELEASE in Spring Boot 3.5.16) takes effect. The parent bump alone would not have been sufficient without also removing this override.

com.fasterxml.jackson.core:jackson-databind

jackson-databind is a transitive dependency managed by the spring-boot-starter-parent BOM via an imported jackson-bom. The parent bump to 3.5.16 delivers jackson-bom.version=2.21.4, which satisfies the earlier advisory floor of 2.18.8 but falls below the patched floor of 2.21.5 required for CVE-2026-59889 and GHSA-mhm7-754m-9p8w. The next Spring Boot release that delivers jackson-databind ≥ 2.21.5 is 4.0.8, which is a prohibited major-version jump. A <jackson-bom.version>2.21.5</jackson-bom.version> property override was therefore added to the project's <properties> block; Spring Boot's spring-boot-dependencies BOM uses this exact property name to control the imported Jackson BOM, so the override lifts all Jackson artifacts to 2.21.5 while keeping the project on the Spring Boot 3.5.x line.

Version changes

Package	From	To	Why updated
org.springframework.boot:spring-boot-starter-parent	3.5.6	3.5.16	Parent bump to deliver patched Tomcat, Spring Security, and Thymeleaf versions transitively
com.thoughtworks.xstream:xstream	1.4.5	1.4.20	Direct CVE fix via xstream.version property
org.thymeleaf:thymeleaf	3.1.2.RELEASE	3.1.5.RELEASE	Local thymeleaf.version override removed; now inherits patched version from parent bump
org.thymeleaf:thymeleaf-spring6	3.1.2.RELEASE	3.1.5.RELEASE	Same as above — sibling artifact under the same BOM property
org.apache.tomcat.embed:tomcat-embed-core	10.1.46	10.1.55	Transitive after parent bump (spring-boot-starter-parent 3.5.16)
org.apache.tomcat.embed:tomcat-embed-websocket	10.1.46	10.1.55	Transitive after parent bump (spring-boot-starter-parent 3.5.16)
org.apache.tomcat:tomcat-coyote	10.1.46	10.1.55	Transitive after parent bump (spring-boot-starter-parent 3.5.16)
org.apache.tomcat:tomcat-catalina	10.1.46	10.1.55	Transitive after parent bump (spring-boot-starter-parent 3.5.16)
org.apache.tomcat:tomcat-util	10.1.46	10.1.55	Transitive after parent bump (spring-boot-starter-parent 3.5.16)
org.springframework.security:spring-security-core	6.5.5	6.5.11	Transitive after parent bump (spring-boot-starter-parent 3.5.16)
org.springframework.security:spring-security-config	6.5.5	6.5.11	Transitive after parent bump (spring-boot-starter-parent 3.5.16)
org.springframework.security:spring-security-web	6.5.5	6.5.11	Transitive after parent bump (spring-boot-starter-parent 3.5.16)
com.fasterxml.jackson.core:jackson-databind	2.21.4	2.21.5	Override via jackson-bom.version property; parent bump alone only reached 2.21.4, below patched floor of 2.21.5

[aikido-autofix]

Aikido's automated cron job opened a newer AutoFix. It fixes the same vulnerabilities and more: [Aikido] Fix 1 critical issue in spring-security-core, spring-security-config, spring-security-web and 66 other issues