catalogue . Java xStream . DynamicProxyConverter . java.beans.EventHandler . RCE via XStream object deserialization . Standard way to serialize and deserialize Objects with XStream . SECURITY- / CVE-- . What to do about it 0. 利用方式跟踪 目前为止,已知有两个触发方式 xs…