Loading CVE intelligence

CVE-2020-26217

HighPublished

Remote Code Execution in XStream

Published: Nov 16, 2020
Updated: Aug 4, 2024
Assigning CNA: GitHub_M
Evidence observed: Aug 8, 2026

Primary CVSS

8.8/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS probability estimate

85.0%

High · next 30 days

Percentile: 99.7%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

Sources

7

CVE-2020-26217PoC
CVE-2020-26217 && XStream RCE
CVE-2020-26217-XStreamExploit
CVE-2020-26217 XStream反序列化的poc
CVE-2020-26217-XStream-RCE-POCPoC
CVE-2020-26217 XStream RCE POC

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.

xstream-CVE-2020-26217

PoC

Proof-of-concept exploit for CVE-2020-26217, a remote code execution vulnerability in XStream XML deserialization. Demonstrates exploitation of insecure deserialization in Java applications.

XStream-1Exploit

Java library for XML serialization and deserialization, with a focus on CVE-2020-26217 exploitation. Enables converting Java objects to XML and back, commonly used in security testing for deserialization vulnerabilities.

CVE-2020-26259PoC

CVE-2020-26259: XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights.

x-stream__xstream_CVE-2020-26217_1-4-14-java77Exploit

Java library for XML serialization and deserialization, with a focus on the CVE-2020-26217 deserialization vulnerability exploit.