{"id":"GHSA-r937-wjx7-w2jp","summary":"JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution","details":"In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata","aliases":["CVE-2026-53914"],"modified":"2026-08-12T19:40:59.256901Z","published":"2026-06-26T15:32:13Z","database_specific":{"nvd_published_at":"2026-06-26T14:17:05Z","cwe_ids":["CWE-502"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-08-12T19:25:23Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53914"},{"type":"WEB","url":"https://github.com/JetBrains/kotlin/commit/bf51df665b458fda7c3eaf436c4d88dc119d7ec6"},{"type":"PACKAGE","url":"https://github.com/JetBrains/kotlin"},{"type":"WEB","url":"https://github.com/JetBrains/kotlin/releases/tag/v2.4.20-Beta1"},{"type":"WEB","url":"https://www.jetbrains.com/privacy-security/issues-fixed"}],"affected":[{"package":{"name":"org.jetbrains.kotlin:kotlin-gradle-plugin","ecosystem":"Maven","purl":"pkg:maven/org.jetbrains.kotlin/kotlin-gradle-plugin"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.20-Beta1"}]}],"versions":["0.0.1-test-deploy","0.0.2-test-deploy","0.1.1.2-5-test-2","0.1.1.2-5-test-4","0.1.1.2-5-test-5","0.10.1316","0.10.195","0.10.4","0.10.709","0.10.770","0.11.91","0.11.91.1","0.11.91.2","0.11.91.4","0.12.1218","0.12.1230","0.12.200","0.12.213","0.12.412","0.12.613","0.13.1513","0.13.1514","0.13.1516","0.14.449","0.14.451","0.5.1131","0.5.998","0.6.1070","0.6.1315","0.6.1411","0.6.1507","0.6.1590","0.6.1603","0.6.1617","0.6.1658","0.6.1670","0.6.1673","0.6.179","0.6.1910","0.6.22","0.6.2451","0.6.2517","0.6.31","0.6.317","0.6.350","0.6.594","0.6.602","0.6.69","0.6.786","0.6.800","0.6.912","0.7.1090","0.7.115","0.7.1217","0.7.191","0.7.258","0.7.270","0.7.271","0.7.802","0.7.852","0.7.86","0.7.895","0.8.11","0.8.1527","0.8.484","0.8.679","0.9.0-native","0.9.1-native","0.9.206","0.9.66","0.9.976","1.0.0","1.0.0-beta-1038","1.0.0-beta-1103","1.0.0-beta-2417","1.0.0-beta-2422","1.0.0-beta-2423","1.0.0-beta-3593","1.0.0-beta-3594","1.0.0-beta-3595","1.0.0-beta-4583","1.0.0-beta-4584","1.0.0-beta-4589","1.0.0-rc-1036","1.0.1","1.0.1-1","1.0.1-2","1.0.2","1.0.2-1","1.0.3","1.0.4","1.0.5","1.0.5-2","1.0.5-3","1.0.6","1.0.7","1.1.0","1.1.1","1.1.2","1.1.2-2","1.1.2-3","1.1.2-4","1.1.2-5","1.1.3","1.1.3-2","1.1.4","1.1.4-2","1.1.4-3","1.1.50","1.1.51","1.1.60","1.1.61","1.2.0","1.2.10","1.2.20","1.2.21","1.2.30","1.2.31","1.2.40","1.2.41","1.2.50","1.2.51","1.2.60","1.2.61","1.2.70","1.2.71","1.3.0","1.3.0-rc-190","1.3.0-rc-198","1.3.10","1.3.11","1.3.20","1.3.21","1.3.30","1.3.31","1.3.40","1.3.41","1.3.50","1.3.60","1.3.61","1.3.70","1.3.71","1.3.72","1.4.0","1.4.0-rc","1.4.10","1.4.20","1.4.20-M1","1.4.20-M2","1.4.20-RC","1.4.21","1.4.21-2","1.4.30","1.4.30-M1","1.4.30-RC","1.4.31","1.4.32","1.5.0","1.5.0-M1","1.5.0-M2","1.5.0-RC","1.5.10","1.5.20","1.5.20-M1","1.5.20-RC","1.5.21","1.5.30","1.5.30-M1","1.5.30-RC","1.5.31","1.5.32","1.6.0","1.6.0-M1","1.6.0-RC","1.6.0-RC2","1.6.10","1.6.10-RC","1.6.20","1.6.20-M1","1.6.20-RC","1.6.20-RC2","1.6.21","1.7.0","1.7.0-Beta","1.7.0-RC","1.7.0-RC2","1.7.10","1.7.20","1.7.20-Beta","1.7.20-RC","1.7.21","1.7.22","1.8.0","1.8.0-343","1.8.0-Beta","1.8.0-RC","1.8.0-RC2","1.8.10","1.8.20","1.8.20-Beta","1.8.20-RC","1.8.20-RC2","1.8.21","1.8.22","1.9.0","1.9.0-Beta","1.9.0-RC","1.9.10","1.9.20","1.9.20-Beta","1.9.20-Beta2","1.9.20-RC","1.9.20-RC2","1.9.21","1.9.22","1.9.23","1.9.24","1.9.25","2.0.0","2.0.0-Beta1","2.0.0-Beta2","2.0.0-Beta3","2.0.0-Beta4","2.0.0-Beta5","2.0.0-RC1","2.0.0-RC2","2.0.0-RC3","2.0.10","2.0.10-RC","2.0.10-RC2","2.0.20","2.0.20-Beta1","2.0.20-Beta2","2.0.20-RC","2.0.20-RC2","2.0.21","2.0.21-RC","2.1.0","2.1.0-Beta1","2.1.0-Beta2","2.1.0-RC","2.1.0-RC2","2.1.10","2.1.10-RC","2.1.10-RC2","2.1.20","2.1.20-Beta1","2.1.20-Beta2","2.1.20-RC","2.1.20-RC2","2.1.20-RC3","2.1.21","2.1.21-RC","2.1.21-RC2","2.2.0","2.2.0-Beta1","2.2.0-Beta2","2.2.0-RC","2.2.0-RC2","2.2.0-RC3","2.2.10","2.2.10-RC","2.2.10-RC2","2.2.20","2.2.20-Beta1","2.2.20-Beta2","2.2.20-RC","2.2.20-RC2","2.2.21","2.2.21-RC","2.2.21-RC2","2.3.0","2.3.0-Beta1","2.3.0-Beta2","2.3.0-RC","2.3.0-RC2","2.3.0-RC3","2.3.10","2.3.10-RC","2.3.10-RC2","2.3.20","2.3.20-Beta1","2.3.20-Beta2","2.3.20-RC","2.3.20-RC2","2.3.20-RC3","2.3.21","2.3.21-RC","2.3.21-RC2","2.4.0","2.4.0-Beta1","2.4.0-Beta2","2.4.0-RC","2.4.0-RC2","2.4.10","2.4.10-RC","2.4.10-RC2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-r937-wjx7-w2jp/GHSA-r937-wjx7-w2jp.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L"}]}