CVE-2020-26217

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Nov 16, 2020
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2020

CVE-2020-262186.1touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which co CVE-2020-262196.1touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many, and vary from theft of information and credentials, to CVE-2020-26226.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions CVE-2020-262203.5toucbase.ai before version 2.0 leaks information by not stripping exif data from images. Anyone with access to the uploaded image of other u CVE-2020-262216.1touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting (XSS). The vulnerability allows an attacker to send malicious JavaScri CVE-2020-262228.8Dependabot is a set of packages for automated dependency management for Ruby, JavaScript, Python, PHP, Elixir, Rust, Java, .NET, Elm and Go.CVE-2020-262236.5Spree is a complete open source e-commerce solution built with Ruby on Rails. In Spree from version 3.7 and before versions 3.7.13, 4.0.5, a CVE-2020-262247.5In PrestaShop before version 1.7.6.9 an attacker is able to list all the orders placed on the website without being logged by abusing the fu CVE-2020-262256.1In PrestaShop Product Comments before version 4.2.0, an attacker could inject malicious web code into the users' web browsers by creating a CVE-2020-262268.1In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally d CVE-2020-262276.1TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typ CVE-2020-262287.5TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were s