MEDIUM 6.7
GHSA-r937-wjx7-w2jp
JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution
Quick fix
GHSA-r937-wjx7-w2jp — org.jetbrains.kotlin:kotlin-gradle-plugin: upgrade to the fixed version with the command below.
# pom.xml: bump <version>2.4.20-Beta1</version> for org.jetbrains.kotlin:kotlin-gradle-pluginDetails
In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
Are you affected?
Enter the version of the package you're using.
Affected packages
Maven / org.jetbrains.kotlin:kotlin-gradle-plugin
Introduced in:
0 Fixed in: 2.4.20-Beta1 Fix
# pom.xml: bump <version>2.4.20-Beta1</version> for org.jetbrains.kotlin:kotlin-gradle-plugin References
- https://nvd.nist.gov/vuln/detail/CVE-2026-53914 [ADVISORY]
- https://github.com/JetBrains/kotlin/commit/bf51df665b458fda7c3eaf436c4d88dc119d7ec6 [WEB]
- https://github.com/JetBrains/kotlin [PACKAGE]
- https://github.com/JetBrains/kotlin/releases/tag/v2.4.20-Beta1 [WEB]
- https://www.jetbrains.com/privacy-security/issues-fixed [WEB]