CVE-2020-26217 — Remote Code Execution in XStream
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the proce…
Published: 2020-11-16 · CVSS: 8.0 · CVSS 3.1
XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7