CVE-2018-18240: Pippo

Critical severity, CVSS 9.8. EPSS: 3.7% chance of exploitation in the next 30 days.

Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.

Affected products

• Pippo Pippo: up to and including 1.11.0

Published 2018-10-11. Last modified 2026-06-17.