Maven · repo1.maven.org
com.adobe.acs:acs-aem-commons-bundle
Java Unsafe Deserialize: ObjectInputStream / XStream.fromXML — untrusted deserialization sink.
Why PkgRadar flagged 6.17.4
| Severity | Signal | Evidence |
|---|---|---|
| medium | Java Unsafe Deserialize | ObjectInputStream / XStream.fromXML — untrusted deserialization sink. · com/adobe/acs/commons/audit_log_search/impl/AuditLogSearchServlet.java |
| medium | Java Dynamic Classload | URLClassLoader / defineClass — runs attacker-provided bytecode. · acscommons/google/common/base/FinalizableReferenceQueue.java |
| medium | Java Process Spawn | Runtime.exec / ProcessBuilder — process spawning. · com/adobe/acs/commons/hc/impl/HealthCheckStatusEmailer.java |
| medium | Java Process Spawn | Runtime.exec / ProcessBuilder — process spawning. · acscommons/jcraft/jsch/Session.java |
| medium | Java Static Init Side Effect | Static-initializer block contains process/network/reflection — runs on first class load (contributory signal). · acscommons/google/common/base/FinalizableReferenceQueue.java |
| medium | Java Static Init Side Effect | Static-initializer block contains process/network/reflection — runs on first class load (contributory signal). · acscommons/jsoup/Connection.java |
| medium | Java Static Init Side Effect | Static-initializer block contains process/network/reflection — runs on first class load (contributory signal). · acscommons/jsoup/helper/AuthenticationHandler.java |
| medium | Java Static Init Side Effect | Static-initializer block contains process/network/reflection — runs on first class load (contributory signal). · acscommons/jsoup/helper/RequestDispatch.java |
| medium | Java Static Init Side Effect | Static-initializer block contains process/network/reflection — runs on first class load (contributory signal). · acscommons/jsoup/helper/HttpConnection.java |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
6.17.4 | Review | 36 | 2026-06-20 |
Block this in CI
pkgradar gate --ecosystem maven com.adobe.acs:[email protected]