{
  "cveId": "CVE-2020-26217",
  "url": "https://patchblox.com/security/cve/CVE-2020-26217",
  "summary": "CVE-2020-26217 is fixed in libxstream-java on 1 platform, first by libxstream-java 1.4.11.1-1~18.04.1, released December 15, 2020. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "libxstream-java: XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to...",
  "description": "XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream\u0027s Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.",
  "published": "2020-11-16T13:15:00Z",
  "severity": "Medium",
  "epss": 0.84968,
  "epssPercentile": 0.99713,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "libxstream-java",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "1.4.11.1-1~18.04.1",
      "fix": "libxstream-java 1.4.11.1-1~18.04.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-libxstream-java-1.4.11.1-1-18.04.1",
      "released": "2020-12-15T17:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libxstream-java",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.4.11.1-1ubuntu0.1",
      "fix": "libxstream-java 1.4.11.1-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-libxstream-java-1.4.11.1-1ubuntu0.1",
      "released": "2020-12-15T17:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}