XMLDecoder deserializes arbitrary objects and can execute attacker-supplied code.
Do not use XMLDecoder on untrusted input; use a safe data-binding library with restricted types.