~ / search / GHSA-r937-wjx7-w2jp

GHSA-r937-wjx7-w2jp

JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-53914

Packages

EcosystemPackageAffectedFixed in
Maven org.jetbrains.kotlin:kotlin-gradle-plugin < 2.4.20-Beta1 2.4.20-Beta1

Details

As written in the advisory (Markdown source, shown as plain text).

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

References

External links from the advisory. They lead to third-party sites.