diff --git a/pom.xml b/pom.xml
index 67b99fc4..e9dc6ba4 100644
--- a/pom.xml
+++ b/pom.xml
@@ -74,6 +74,13 @@
       <version>3.4.2</version>
       <scope>runtime</scope>
     </dependency>
+    <dependency>
+      <!-- fix CVE-2021-29425 -->
+      <groupId>commons-io</groupId>
+      <artifactId>commons-io</artifactId>
+      <version>2.7</version>
+      <scope>runtime</scope>
+    </dependency>
     <dependency>
       <!-- this is to support use of Groovysh (Groovy jars don't include) -->
       <groupId>org.fusesource.jansi</groupId>