[krzyk]

But maven does not.

[oftenwrong]

Maven plugins and extensions can execute arbitrary code, so you should still exercise care when running an untrusted maven project.

[stefs]

you mean because it's xml instead of executable code?

[krzyk]

No, because it was designed that way - declarative.

You can have xml with code-like-structures, e.g. Ant