m = new XStream();
xstream.fromXML(xml);
</pre></div>

    <p>Depending on the JDK, the code from the remote server is executed as soon as the XML gets unmarshalled.</p>

    <p>Note, this example uses XML, but the attack can be performed for any supported format. e.g. JSON.</p>

    <h2 id="impact">Impact</h2>

    <p>The vulnerability may allow a remote attacker to execute arbitrary code only by manipulating the processed
    input stream.</p>

    <h2 id="workarounds">Workarounds</h2>

    <p>See <a href