High
Security advisory
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-26217
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:26 UTC · Revision 1
Source evidence
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
osv:CVE-2020-26217
Complete source record
{
"id": "dcb735ebb2c1241fde36fabec0a519c618a0044fd27bf588cab3e3815bf0d8ca",
"url": "https://osv.dev/vulnerability/CVE-2020-26217",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-26217",
"summary": "XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.",
"evidence": "osv:CVE-2020-26217",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2020-26217",
"aliases": [
"BIT-activemq-2020-26217",
"CVE-2020-26217",
"GHSA-mw36-7c6c-q4q2"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/activemq",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "a0d4141a00ba5de4afaee160836898b41eb28065"
},
{
"introduced": "86dd78b1aa64cbf0af15669c0e4af62dfae0d158"
},
{
"last_affected": "86dd78b1aa64cbf0af15669c0e4af62dfae0d158"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:activemq:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "5.15.14"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:apache:activemq:5.16.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "5.16.0"
},
{
"last_affected": "5.16.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"5.16.0",
"activemq-5.16.0",
"activemq-5.15.13",
"activemq-5.15.12",
"activemq-5.15.11",
"activemq-5.15.10",
"activemq-5.15.9",
"activemq-5.15.8",
"activemq-5.15.7",
"activemq-5.15.6",
"activemq-5.15.5",
"activemq-5.15.4",
"activemq-5.15.3",
"activemq-5.15.2",
"activemq-5.15.1",
"activemq-5.15.0",
"activemq-5.14.0",
"activemq-5.13.0",
"activemq-5.12.0",
"activemq-5.11.0",
"activemq-5.10.0",
"activemq-5.9.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26217.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/x-stream/xstream",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "b9f6f5924681f1d37484df4197712bb768f7ec44"
},
{
"fixed": "0fec095d534126931c99fd38e9c6d41f5c685c1a"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:xstream:xstream:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.4.14"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "0fec095d534126931c99fd38e9c6d41f5c685c1a"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"XSTREAM_1_4_13",
"XSTREAM_1_4_12",
"XSTREAM_1_4_11_1",
"XSTREAM_1_4_11",
"XSTREAM_1_4_10",
"XSTREAM_1_4_9",
"XSTREAM_1_4_5"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-26217.json",
"vanir_signatures": [
{
"id": "CVE-2020-26217-62fc4d1d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"36534078420505951630932717155066595606",
"167712592239746094751306022918018252816",
"317644733730249586699082543719012497198",
"147882892005919619167157629845016475938",
"310112206937186273496457350593858618322",
"212400998281365619402932426753096858535",
"98561082973858442458491193662279704329",
"140566921675937823121313754377213541683",
"55865721030239104668089207709746320035",
"226613955031940672379347694521770861245",
"224905054078361424294810803415096163072",
"304917238615893824511506291964377504692",
"95782208176028131388695258941550121531",
"28837992903177281865669434989913590989",
"199170493253428971075703026859805881887",
"37525357282441523443603245142652431206",
"145645811809558746125356472534965652414",
"46124708426586695108529983063240272933",
"13235285845647794166604326647201940192",
"194282790036325872265619217445543145245",
"57524199966063753519088560374134026781",
"302590889855058786938212722740100797184",
"287878836132345066373988020348693799345",
"55388299779160129076428276823673824851",
"79370552315750212097527417749468495751",
"58609552586332135734337986950425982652",
"274080513672262428135865176899633804291",
"140977745494268924825685328415719490273",
"284467441441206600708256211807478500031",
"304917238615893824511506291964377504692",
"95782208176028131388695258941550121531",
"28837992903177281865669434989913590989",
"199170493253428971075703026859805881887",
"37525357282441523443603245142652431206",
"145645811809558746125356472534965652414",
"46124708426586695108529983063240272933",
"330110021267849494055473811230632102184",
"276200769093194371420971142739798509370",
"95737149966117525507760249364270862720",
"263867514275934896738377568056758027090",
"48714228442327568100662768598747861880",
"212494145970732734032500827369388649428",
"182912325341326383473301608361159179741",
"88593924387143450924616786494852175367",
"151438248137756327111752360344123826640",
"248025821406173234794988814544699774100",
"309803324023024585825355197780470987251",
"315797621103349978137933836505191930530",
"82548540201317005602749919447493015094",
"270863949685038507274853685123980255028",
"171405365791934743455499209126098513808",
"244766781187162628268875854624811336252",
"166730865668170713317511943055644070483",
"292822050563300496692888095507552767585",
"63366177943000962629953594979726051287",
"268325377609045880961180859203858421206",
"253171137548256272141904701683387644168",
"262245883024142785000301742972088682103"
]
},
"source": "https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a",
"target": {
"file": "xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-26217-7ccf807b",
"digest": {
"length": 736,
"function_hash": "135430061935714785873177556993178862123"
},
"source": "https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a",
"target": {
"file": "xstream/src/test/com/thoughtworks/acceptance/SecurityVulnerabilityTest.java",
"function": "testExplicitlyConvertEventHandler"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-26217-fda9c622",
"digest": {
"length": 291,
"function_hash": "86372899673399638265050073566564126629"
},
"source": "https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a",
"target": {
"file": "xstream/src/java/com/thoughtworks/xstream/XStream.java",
"function": "setupSecurity"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-26217-fdcfa9c0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"288917004095477301317786229564296666322",
"260891975351421313936228542580575721897",
"182758980270881807918382145153527672156",
"222093423178369917819573038757702447017"
]
},
"source": "https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a",
"target": {
"file": "xstream/src/java/com/thoughtworks/xstream/XStream.java"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:22:40Z"
}
}
],
"modified": "2026-10-24T14:22:40.901810848Z",
"provider": "osv",
"references": [
"https://github.com/x-stream/xstream/security/advisories/GHSA-mw36-7c6c-q4q2",
"https://lists.debian.org/debian-lts-announce/2020/12/msg00001.html",
"https://security.netapp.com/advisory/ntap-20210409-0004/",
"https://www.debian.org/security/2020/dsa-4811",
"https://www.oracle.com/security-alerts/cpuapr2022.html",
"https://www.oracle.com/security-alerts/cpujan2022.html",
"https://lists.apache.org/thread.html/r2de526726e7f4db4a7cb91b7355070779f51a84fd985c6529c2f4e9e%40%3Cissues.activemq.apache.org%3E",
"https://lists.apache.org/thread.html/r7c9fc255edc0b9cd9567093d131f6d33fde4c662aaf912460ef630e9%40%3Ccommits.camel.apache.org%3E",
"https://lists.apache.org/thread.html/r826a006fda71cc96fc87b6eca4b5d195f19a292ad36cea501682c38c%40%3Cissues.activemq.apache.org%3E",
"https://lists.apache.org/thread.html/redde3609b89b2a4ff18b536a06ef9a77deb93d47fda8ed28086fa8c3%40%3Cissues.activemq.apache.org%3E",
"https://github.com/x-stream/xstream/commit/0fec095d534126931c99fd38e9c6d41f5c685c1a",
"https://www.oracle.com//security-alerts/cpujul2021.html",
"https://www.oracle.com/security-alerts/cpuApr2021.html",
"https://www.oracle.com/security-alerts/cpuoct2021.html",
"https://x-stream.github.io/CVE-2020-26217.html"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
},
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_cash_management:14.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_cash_management:14.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_cash_management:14.5:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_cash_management",
"extracted_events": [
{
"range": [
{
"introduced": "14.2"
},
{
"last_affected": "14.2"
},
{
"introduced": "14.3"
},
{
"last_affected": "14.3"
},
{
"introduced": "14.5"
},
{
"last_affected": "14.5"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_corporate_lending_process_management:14.5:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_corporate_lending_process_management",
"extracted_events": [
{
"range": [
{
"introduced": "14.2"
},
{
"last_affected": "14.2"
},
{
"introduced": "14.3"
},
{
"last_affected": "14.3"
},
{
"introduced": "14.5"
},
{
"last_affected": "14.5"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_credit_facilities_process_management:14.5:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_credit_facilities_process_management",
"extracted_events": [
{
"range": [
{
"introduced": "14.2"
},
{
"last_affected": "14.2"
},
{
"introduced": "14.3"
},
{
"last_affected": "14.3"
},
{
"introduced": "14.5"
},
{
"last_affected": "14.5"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_platform:2.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.7.1:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_platform:2.9.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_platform",
"extracted_events": [
{
"range": [
{
"introduced": "2.4.0"
},
{
"last_affected": "2.4.0"
},
{
"introduced": "2.7.1"
},
{
"last_affected": "2.7.1"
},
{
"introduced": "2.9.0"
},
{
"last_affected": "2.9.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_supply_chain_finance:14.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_supply_chain_finance:14.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_supply_chain_finance:14.5:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_supply_chain_finance",
"extracted_events": [
{
"range": [
{
"introduced": "14.2"
},
{
"last_affected": "14.2"
},
{
"introduced": "14.3"
},
{
"last_affected": "14.3"
},
{
"introduced": "14.5"
},
{
"last_affected": "14.5"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_trade_finance_process_management:14.2:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_trade_finance_process_management:14.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_trade_finance_process_management:14.5:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_trade_finance_process_management",
"extracted_events": [
{
"range": [
{
"introduced": "14.2"
},
{
"last_affected": "14.2"
},
{
"introduced": "14.3"
},
{
"last_affected": "14.3"
},
{
"introduced": "14.5"
},
{
"last_affected": "14.5"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:banking_virtual_account_management:14.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_virtual_account_management:14.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:banking_virtual_account_management:14.5.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:banking_virtual_account_management",
"extracted_events": [
{
"range": [
{
"introduced": "14.2.0"
},
{
"last_affected": "14.2.0"
},
{
"introduced": "14.3.0"
},
{
"last_affected": "14.3.0"
},
{
"introduced": "14.5.0"
},
{
"last_affected": "14.5.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:business_activity_monitoring:11.1.1.9.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:business_activity_monitoring:12.2.1.4.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:business_activity_monitoring",
"extracted_events": [
{
"range": [
{
"introduced": "11.1.1.9.0"
},
{
"last_affected": "11.1.1.9.0"
},
{
"introduced": "12.2.1.3.0"
},
{
"last_affected": "12.2.1.3.0"
},
{
"introduced": "12.2.1.4.0"
},
{
"last_affected": "12.2.1.4.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:communications_policy_management:12.5.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:communications_policy_management",
"extracted_events": [
{
"range": [
{
"introduced": "12.5.0"
},
{
"last_affected": "12.5.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0.0:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:endeca_information_discovery_studio",
"extracted_events": [
{
"range": [
{
"introduced": "3.2.0.0"
},
{
"last_affected": "3.2.0.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0.6:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0.4:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_xstore_point_of_service:18.0.3:*:*:*:*:*:*:*",
"cpe:2.3:a:oracle:retail_xstore_point_of_service:19.0.2:*:*:*:*:*:*:*"
],
"vendor_product": "oracle:retail_xstore_point_of_service",
"extracted_events": [
{
"range": [
{
"introduced": "16.0.6"
},
{
"last_affected": "16.0.6"
},
{
"introduced": "17.0.4"
},
{
"last_affected": "17.0.4"
},
{
"introduced": "18.0.3"
},
{
"last_affected": "18.0.3"
},
{
"introduced": "19.0.2"
},
{
"last_affected": "19.0.2"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-26217",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 443680,
"published_at": "2020-11-16T21:15:12.893+00:00"
}