Hacker News Reader

But maven does not.

Maven plugins and extensions can execute arbitrary code, so you should still exercise care when running an untrusted maven project.

you mean because it's xml instead of executable code?

No, because it was designed that way - declarative.

You can have xml with code-like-structures, e.g. Ant