PkgRadar

Maven · repo1.maven.org

org.genestrip:core

Java Unsafe Deserialize: ObjectInputStream / XStream.fromXML — untrusted deserialization sink.

Why PkgRadar flagged 2.9

SeveritySignalEvidence
mediumJava Unsafe DeserializeObjectInputStream / XStream.fromXML — untrusted deserialization sink. · org/metagene/genestrip/bloom/KMerProbFilter.java
mediumJava Unsafe DeserializeObjectInputStream / XStream.fromXML — untrusted deserialization sink. · org/metagene/genestrip/store/KMerStore.java
mediumJava Unsafe DeserializeObjectInputStream / XStream.fromXML — untrusted deserialization sink. · org/metagene/genestrip/store/Database.java
mediumJava Process SpawnRuntime.exec / ProcessBuilder — process spawning. · org/metagene/genestrip/kraken/KrakenExecutor.java

Scanned versions

VersionVerdictScoreScanned (UTC)
2.9Review652026-06-10

Block this in CI

PkgRadar gates org.genestrip:core (and every other dependency) before it merges. One line in your pipeline:

pkgradar gate --ecosystem maven org.genestrip:[email protected]
Start free — 25 scans / moView full evidence