medium6.7
CVE-2026-53914
In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
Impact
In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.jetbrains.kotlin:kotlin-gradle-plugin | < 2.4.20-Beta1 | 2.4.20-Beta1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Jetbrains | Kotlin | before 2.4.20 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-r937-wjx7-w2jp
- https://nvd.nist.gov/vuln/detail/CVE-2026-53914
- https://www.jetbrains.com/privacy-security/issues-fixed
- https://github.com/JetBrains/kotlin/commit/bf51df665b458fda7c3eaf436c4d88dc119d7ec6
- https://github.com/JetBrains/kotlin/releases/tag/v2.4.20-Beta1
- https://www.jetbrains.com/privacy-security/issues-fixed/