Maven · repo1.maven.org
io.gitee.isbool:bp-core
Java Unsafe Deserialize: ObjectInputStream / XStream.fromXML — untrusted deserialization sink.
Why PkgRadar flagged 2.0.1
| Severity | Signal | Evidence |
|---|---|---|
| medium | Java Unsafe Deserialize | ObjectInputStream / XStream.fromXML — untrusted deserialization sink. · bp/pub/util/PubUtil.java |
| medium | Java Process Spawn | Runtime.exec / ProcessBuilder — process spawning. · bp/pub/util/BrowserUtil.java |
Scanned versions
| Version | Verdict | Score | Scanned (UTC) |
|---|---|---|---|
2.0.1 | Review | 35 | 2026-06-17 |
Block this in CI
pkgradar gate --ecosystem maven io.gitee.isbool:[email protected]