CVE-2020-26217 Scanner
Detects 'Remote Code Execution (RCE)' vulnerability in XStream affects v. before 1.4.14.
Used 2.7k times · 3.4k assets checked · domain, ipv4, subdomain
CVE
CVE-2020-26217
8.8
CVSShigh
Exploitable remotely over the internet · low-privilege account sufficient · user interaction needed.
Description
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Attack Vector
Network
Privileges Req.
Low
User Interaction
Required
xstream
Updated Oct 12, 2026View on NVD →
S4E scanner
CVE history: xstream
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →