CVE-2020-26217

Published Nov 16, 2020·Updated Oct 7, 2026

NVD Description

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

Public Exploits & PoCs4 found

[POC] CVE-2020-26217 — CVE-2020-26217

CVE-2020-26217 && XStream RCE

[POC] CVE-2020-26217 — CVE-2020-26217-XStream-RCE-POC

CVE-2020-26217 XStream RCE POC

[POC] CVE-2020-26217 — CVE-2020-26217-XStream

CVE-2020-26217 XStream反序列化的poc

[POC] CVE-2020-26217 — XStream-1

xstream with CVE-2020-26217

Community Discussion

Hacker News

CVE-2020-26217: XStream can be used for Remote Code Execution

based2

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

References

View on NVD Search GitHub Search Google

Get alerted for CVEs like this

Start monitoring free