CVE-2026-53914: JetBrains Kotlin unsafe deserialization in build cache metadata

Executive brief

JetBrains Kotlin is a popular programming language and development toolset. A vulnerability in its build cache system could allow an attacker with high-level access to a local machine to execute malicious code. This could lead to unauthorized access to sensitive development data or a compromise of the software build process.

Technical details

An unsafe deserialization vulnerability (CWE-502) exists in the JetBrains Kotlin Gradle Plugin's build cache metadata handling. Before version 2.4.20, the plugin failed to sufficiently validate untrusted data during deserialization, potentially allowing for arbitrary code execution. Exploitation requires a local attack vector with high privileges and high attack complexity, but it results in a scope change (S:C), impacting components beyond the immediate build cache. The issue is addressed in version 2.4.20-Beta1 and later.

Affected products

• JetBrains kotlin-gradle-plugin < 2.4.20-Beta1

Timeline

• 2026-06-26: advisory
• 2026-06-26: disclosed
• 2026-08-12: patched: GitHub reviewed date; patch available in 2.4.20-Beta1

References

• https://api.github.com/users/marcelstoer
• https://github.com/marcelstoer
• https://api.github.com/users/marcelstoer/gists%7B/gist_id%7D
• https://api.github.com/users/marcelstoer/repos
• https://avatars.githubusercontent.com/u/624195?v=4
• https://api.github.com/users/marcelstoer/events%7B/privacy%7D