 objects.
    XStream creates therefore new instances based on these type information.  An attacker can manipulate the processed
    input stream and replace or inject objects, that result in execution of arbitrary code loaded from a remote server.</p>

    <h2 id="reproduction">Steps to Reproduce</h2>

    <p>Create a simple TreeSet and use XStream to marshal it to XML.  Replace the XML with following snippet and
    unmarshal it again with XStream:</p>
<div class="Source XML"><pre>&lt;sorted-set&gt;
  &lt