[java-sig-commits] [Bug 1898907] CVE-2020-26217 XStream: remote code execution due to insecure XML deserialization when relying on blocklists