diff --git a/core/build.gradle b/core/build.gradle
index 8213c8fa4f3..cf708601213 100644
--- a/core/build.gradle
+++ b/core/build.gradle
@@ -71,7 +71,8 @@ dependencies {
     compile ([group: 'commons-io', name: 'commons-io', version: '2.6' ])
     compile ([group: 'org.apache.commons', name: 'commons-lang3', version: '3.7'])
     compile ([group: 'org.apache.httpcomponents', name: 'httpclient', version: '4.5.3'])
-    compile ([group: 'com.thoughtworks.xstream', name: 'xstream', version: '1.4.15'])
+    compile ([group: 'com.thoughtworks.xstream', name: 'xstream', version: '1.4.18'])
+    compile ([group: 'xpp3', name: 'xpp3_min', version: '1.1.4c'])
     compile ([group: 'com.google.code.gson', name: 'gson', version: '2.8.9'])
     // update transitive dependency version
     compile ([group: 'com.google.guava', name: 'guava', version: '27.1-android'])
diff --git a/core/gradle/dependency-locks/runtimeClasspath.lockfile b/core/gradle/dependency-locks/runtimeClasspath.lockfile
index a06919e0a50..fb72c74e424 100644
--- a/core/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/core/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -8,11 +8,12 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.1-android
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
-com.thoughtworks.xstream:xstream:1.4.15
+com.thoughtworks.xstream:xstream:1.4.18
 commons-codec:commons-codec:1.9
 commons-io:commons-io:2.6
 commons-logging:commons-logging:1.2
 eu.infomas:annotation-detector:3.0.5
+io.github.x-stream:mxparser:1.2.2
 org.apache.commons:commons-lang3:3.7
 org.apache.httpcomponents:httpclient:4.5.3
 org.apache.httpcomponents:httpcore:4.4.6
diff --git a/logging/common/gradle/dependency-locks/runtimeClasspath.lockfile b/logging/common/gradle/dependency-locks/runtimeClasspath.lockfile
index 49830911b37..1c3559e7cb0 100644
--- a/logging/common/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/logging/common/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -8,11 +8,12 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.1-android
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
-com.thoughtworks.xstream:xstream:1.4.15
+com.thoughtworks.xstream:xstream:1.4.18
 commons-codec:commons-codec:1.9
 commons-io:commons-io:2.6
 commons-logging:commons-logging:1.2
 eu.infomas:annotation-detector:3.0.5
+io.github.x-stream:mxparser:1.2.2
 org.apache.commons:commons-lang3:3.7
 org.apache.httpcomponents:httpclient:4.5.3
 org.apache.httpcomponents:httpcore:4.4.6
diff --git a/logging/log4j1_2/gradle/dependency-locks/runtimeClasspath.lockfile b/logging/log4j1_2/gradle/dependency-locks/runtimeClasspath.lockfile
index 49830911b37..1c3559e7cb0 100644
--- a/logging/log4j1_2/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/logging/log4j1_2/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -8,11 +8,12 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.1-android
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
-com.thoughtworks.xstream:xstream:1.4.15
+com.thoughtworks.xstream:xstream:1.4.18
 commons-codec:commons-codec:1.9
 commons-io:commons-io:2.6
 commons-logging:commons-logging:1.2
 eu.infomas:annotation-detector:3.0.5
+io.github.x-stream:mxparser:1.2.2
 org.apache.commons:commons-lang3:3.7
 org.apache.httpcomponents:httpclient:4.5.3
 org.apache.httpcomponents:httpcore:4.4.6
diff --git a/logging/log4j2/gradle/dependency-locks/runtimeClasspath.lockfile b/logging/log4j2/gradle/dependency-locks/runtimeClasspath.lockfile
index 49830911b37..1c3559e7cb0 100644
--- a/logging/log4j2/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/logging/log4j2/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -8,11 +8,12 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.1-android
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
-com.thoughtworks.xstream:xstream:1.4.15
+com.thoughtworks.xstream:xstream:1.4.18
 commons-codec:commons-codec:1.9
 commons-io:commons-io:2.6
 commons-logging:commons-logging:1.2
 eu.infomas:annotation-detector:3.0.5
+io.github.x-stream:mxparser:1.2.2
 org.apache.commons:commons-lang3:3.7
 org.apache.httpcomponents:httpclient:4.5.3
 org.apache.httpcomponents:httpcore:4.4.6
diff --git a/logging/logback/gradle/dependency-locks/runtimeClasspath.lockfile b/logging/logback/gradle/dependency-locks/runtimeClasspath.lockfile
index f4a8020bbdc..991af2575a9 100644
--- a/logging/logback/gradle/dependency-locks/runtimeClasspath.lockfile
+++ b/logging/logback/gradle/dependency-locks/runtimeClasspath.lockfile
@@ -10,11 +10,12 @@ com.google.guava:failureaccess:1.0.1
 com.google.guava:guava:27.1-android
 com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
 com.google.j2objc:j2objc-annotations:1.1
-com.thoughtworks.xstream:xstream:1.4.15
+com.thoughtworks.xstream:xstream:1.4.18
 commons-codec:commons-codec:1.9
 commons-io:commons-io:2.6
 commons-logging:commons-logging:1.2
 eu.infomas:annotation-detector:3.0.5
+io.github.x-stream:mxparser:1.2.2
 org.apache.commons:commons-lang3:3.7
 org.apache.httpcomponents:httpclient:4.5.3
 org.apache.httpcomponents:httpcore:4.4.6