CVE-2020-26217
Remote Code Execution in XStream
- State
- Published
- Severity
- 8.0 High
- Published
- Nov 16, 2020
- Updated
- Oct 7, 2026
- Reserved
- Oct 1, 2020
Description
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.0 High | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H | GitHub_M |
Weaknesses
- CWE-78 OS Command Injection
Affected Products
| Product | Versions |
|---|---|
xstreamx-stream |
|
References
- https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2
- https://x-stream.github.io/CVE-2020-26217.html
- https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a
- [debian-lts-announce] 20201201 [SECURITY] [DLA 2471-1] libxstream-java security updatemailing-list
- DSA-4811vendor-advisory
- [activemq-issues] 20201230 [jira] [Created] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217mailing-list
- [activemq-issues] 20201230 [jira] [Updated] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217mailing-list
- [activemq-issues] 20210104 [jira] [Resolved] (AMQ-8107) Does ActiveMQ use the affected functionality within Xstream libraries for CVE-2020-26217mailing-list
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://security.netapp.com/advisory/ntap-20210409-0004/
- https://www.oracle.com//security-alerts/cpujul2021.html
- [camel-commits] 20211006 [camel] branch main updated: Camel-XStream: Added a test about CVE-2020-26217mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.