PkgRadar

Maven · repo1.maven.org

com.github.ifeilong:feilong

Java Unsafe Deserialize: ObjectInputStream / XStream.fromXML — untrusted deserialization sink.

Why PkgRadar flagged 4.5.4

SeveritySignalEvidence
mediumJava Unsafe DeserializeObjectInputStream / XStream.fromXML — untrusted deserialization sink. · com/feilong/lib/lang3/SerializationUtils.java
mediumJava Unsafe DeserializeObjectInputStream / XStream.fromXML — untrusted deserialization sink. · com/feilong/lib/org/apache/http/impl/client/BasicAuthCache.java
mediumJava Dynamic ClassloadURLClassLoader / defineClass — runs attacker-provided bytecode. · com/feilong/lib/javassist/util/proxy/DefinePackageHelper.java
mediumJava Dynamic ClassloadURLClassLoader / defineClass — runs attacker-provided bytecode. · com/feilong/lib/javassist/util/proxy/DefineClassHelper.java
mediumJava Dynamic ClassloadURLClassLoader / defineClass — runs attacker-provided bytecode. · com/feilong/lib/javassist/Loader.java
mediumJava Dynamic ClassloadURLClassLoader / defineClass — runs attacker-provided bytecode. · com/feilong/lib/ognl/security/OgnlSecurityManagerFactory.java
mediumJava Dynamic ClassloadURLClassLoader / defineClass — runs attacker-provided bytecode. · com/feilong/lib/ognl/enhance/EnhancedClassLoader.java

Scanned versions

VersionVerdictScoreScanned (UTC)
4.5.4Review1002026-06-11
4.5.3Low risk02026-06-10

Block this in CI

PkgRadar gates com.github.ifeilong:feilong (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem maven com.github.ifeilong:[email protected]
Start free — 25 scans / moView full evidence