CVE-2020-26217: XStream can be used for Remote Code Execution in com.thoughtworks.xstream:xstream
Summary
CVE-2020-26217: XStream can be used for Remote Code Execution. Affects com.thoughtworks.xstream:xstream versions < 1.4.14-jdk7. Fixed in 1.4.14-jdk7. How to fix ↓
Also tracked for
- activemq · Bitnami
- libxstream-java · Debian:11
The same CVE-2020-26217 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
XStream is a Java library that allows objects to be serialized and deserialized to XML. It provides a simple API for converting Java objects to XML and vice versa. XStream is widely used in various Java applications and frameworks for data serialization and deserialization. However, a vulnerability has been discovered in XStream that can lead to remote code execution.
Vulnerability Detail
The vulnerability in XStream allows a remote attacker to execute arbitrary shell commands by manipulating the processed input stream. This can result in unauthorized access, data leakage, and potential compromise of the affected system. The vulnerability affects versions of XStream up to 1.4.13.
How To Fix
Latest published version: 1.4.21 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.14-jdk7
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to immediately upgrade to version 1.4.14, there are several workarounds available depending on the version of XStream you are using. Users of XStream 1.4.13 can add two lines of code to the setup code to deny the execution of critical types. Users of XStream 1.4.12 to 1.4.7 will need to set up a blacklist of denied types. Users of XStream 1.4.6 or below can register a custom converter to prevent the unmarshalling of critical types. Please refer to the XStream documentation for detailed instructions on implementing these workarounds.
Conclusion
The vulnerability in XStream can lead to remote code execution, allowing an attacker to run arbitrary shell commands. It is crucial to upgrade to the latest version of XStream or implement the recommended workarounds to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.thoughtworks.xstream:xstream →
FAQ
XStream is a Java library that allows objects to be serialized and deserialized to XML. It provides a simple API for converting Java objects to XML and vice versa.
The vulnerability allows a remote attacker to execute arbitrary shell commands, potentially leading to unauthorized access, data leakage, and compromise of the affected system.
You can fix the vulnerability by upgrading to at least version 1.4.14 of XStream. Alternatively, you can implement the recommended workarounds depending on the version of XStream you are using.
There are currently no known exploits for this vulnerability. However, it is important to apply the necessary patches or workarounds to mitigate the risk.
You can find more information about this vulnerability in XStream's documentation for CVE-2020-26217. Additionally, you can reach out to the XStream community for further assistance.
References
Related vulnerabilities
Recent vulnerabilities recorded for com.thoughtworks.xstream:xstream.
