jetbrains/kotlin · Security
JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution
- GHSA ID
- GHSA-r937-wjx7-w2jp
- CVE ID
- CVE-2026-53914
- Severity
- medium
- Published
- Updated
- CVSS
- 6.7 · CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
- CVSS v3
- 6.7 · CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
Description
In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
CWEs
- CWE-502 · Deserialization of Untrusted Data
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-53914 ↗
- https://www.jetbrains.com/privacy-security/issues-fixed ↗
- https://github.com/JetBrains/kotlin/commit/bf51df665b458fda7c3eaf436c4d88dc119d7ec6 ↗
- https://github.com/JetBrains/kotlin/releases/tag/v2.4.20-Beta1 ↗
- https://github.com/advisories/GHSA-r937-wjx7-w2jp ↗