{"id":"CVE-2026-53914","aliases":["CLSA-2026-1793139590","CLSA-2026-1794245205","CLSA-2026-1794398674","EUVD-2026-39659","GHSA-r937-wjx7-w2jp"],"status":"published","title":"JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution","description":"In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0035,"percentile":0.2902,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2026-06-26T13:01:00Z","modified":"2026-11-11T19:30:03Z","fixes":[{"ecosystem":"Maven","package":"org.jetbrains.kotlin:kotlin-gradle-plugin","fixed_in":["2.4.20-Beta1"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.jetbrains.kotlin:kotlin-gradle-plugin","fixed_in":["1.9.24-tuxcare.1","1.9.25-tuxcare.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.jetbrains.kotlin:kotlin-gradle-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.20-Beta1"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.jetbrains.kotlin:kotlin-gradle-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.24"},{"fixed":"1.9.24-tuxcare.1"}]}],"versions":["1.9.24"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.jetbrains.kotlin:kotlin-gradle-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.9.25"},{"fixed":"1.9.25-tuxcare.1"}]}],"versions":["1.9.25"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.jetbrains.kotlin:kotlin-gradle-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.0-tuxcare.1"}]}],"versions":["1.6.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.jetbrains.kotlin:kotlin-stdlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.6.0"},{"fixed":"1.6.0-tuxcare.1"}]}],"versions":["1.6.0"],"bundled":2},{"source":"osv","ecosystem":"Maven","package":"org.jetbrains.kotlin:kotlin-gradle-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.20-Beta1"}]}],"versions":["0.0.1-test-deploy","0.0.2-test-deploy","0.1.1.2-5-test-2","0.1.1.2-5-test-4","0.1.1.2-5-test-5","0.10.1316","0.10.195","0.10.4","0.10.709","0.10.770","0.11.91","0.11.91.1","0.11.91.2","0.11.91.4","0.12.1218","0.12.1230","0.12.200","0.12.213","0.12.412","0.12.613","0.13.1513","0.13.1514","0.13.1516","0.14.449","0.14.451","0.5.1131","0.5.998","0.6.1070","0.6.1315","0.6.1411","0.6.1507","0.6.1590","0.6.1603","0.6.1617","0.6.1658","0.6.1670","0.6.1673","0.6.179","0.6.1910","0.6.22","0.6.2451","0.6.2517","0.6.31","0.6.317","0.6.350","0.6.594","0.6.602","0.6.69","0.6.786","0.6.800","0.6.912","0.7.1090","0.7.115","0.7.1217","0.7.191","0.7.258","0.7.270","0.7.271","0.7.802","0.7.852","0.7.86","0.7.895","0.8.11","0.8.1527","0.8.484","0.8.679","0.9.0-native","0.9.1-native","0.9.206","0.9.66","0.9.976","1.0.0","1.0.0-beta-1038","1.0.0-beta-1103","1.0.0-beta-2417","1.0.0-beta-2422","1.0.0-beta-2423","1.0.0-beta-3593","1.0.0-beta-3594","1.0.0-beta-3595","1.0.0-beta-4583","1.0.0-beta-4584","1.0.0-beta-4589","1.0.0-rc-1036","1.0.1","1.0.1-1","1.0.1-2","1.0.2","1.0.2-1","1.0.3","1.0.4","1.0.5","1.0.5-2","1.0.5-3","1.0.6","1.0.7","1.1.0","1.1.1","1.1.2","1.1.2-2","1.1.2-3","1.1.2-4","1.1.2-5","1.1.3","1.1.3-2","1.1.4","1.1.4-2","1.1.4-3","1.1.50","1.1.51","1.1.60","1.1.61","1.2.0","1.2.10","1.2.20","1.2.21","1.2.30","1.2.31","1.2.40","1.2.41","1.2.50","1.2.51","1.2.60","1.2.61","1.2.70","1.2.71","1.3.0","1.3.0-rc-190","1.3.0-rc-198","1.3.10","1.3.11","1.3.20","1.3.21","1.3.30","1.3.31","1.3.40","1.3.41","1.3.50","1.3.60","1.3.61","1.3.70","1.3.71","1.3.72","1.4.0","1.4.0-rc","1.4.10","1.4.20","1.4.20-M1","1.4.20-M2","1.4.20-RC","1.4.21","1.4.21-2","1.4.30","1.4.30-M1","1.4.30-RC","1.4.31","1.4.32","1.5.0","1.5.0-M1","1.5.0-M2","1.5.0-RC","1.5.10","1.5.20","1.5.20-M1","1.5.20-RC","1.5.21","1.5.30","1.5.30-M1","1.5.30-RC","1.5.31","1.5.32","1.6.0","1.6.0-M1","1.6.0-RC","1.6.0-RC2","1.6.10","1.6.10-RC","1.6.20","1.6.20-M1","1.6.20-RC","1.6.20-RC2","1.6.21","1.7.0","1.7.0-Beta","1.7.0-RC","1.7.0-RC2","1.7.10","1.7.20","1.7.20-Beta","1.7.20-RC","1.7.21","1.7.22","1.8.0","1.8.0-343","1.8.0-Beta","1.8.0-RC","1.8.0-RC2","1.8.10","1.8.20","1.8.20-Beta","1.8.20-RC","1.8.20-RC2","1.8.21","1.8.22","1.9.0","1.9.0-Beta","1.9.0-RC","1.9.10","1.9.20","1.9.20-Beta","1.9.20-Beta2","1.9.20-RC","1.9.20-RC2","1.9.21","1.9.22","1.9.23","1.9.24","1.9.25","2.0.0","2.0.0-Beta1","2.0.0-Beta2","2.0.0-Beta3","2.0.0-Beta4","2.0.0-Beta5","2.0.0-RC1","2.0.0-RC2","2.0.0-RC3","2.0.10","2.0.10-RC","2.0.10-RC2","2.0.20","2.0.20-Beta1","2.0.20-Beta2","2.0.20-RC","2.0.20-RC2","2.0.21","2.0.21-RC","2.1.0","2.1.0-Beta1","2.1.0-Beta2","2.1.0-RC","2.1.0-RC2","2.1.10","2.1.10-RC","2.1.10-RC2","2.1.20","2.1.20-Beta1","2.1.20-Beta2","2.1.20-RC","2.1.20-RC2","2.1.20-RC3","2.1.21","2.1.21-RC","2.1.21-RC2","2.2.0","2.2.0-Beta1","2.2.0-Beta2","2.2.0-RC","2.2.0-RC2","2.2.0-RC3","2.2.10","2.2.10-RC","2.2.10-RC2","2.2.20","2.2.20-Beta1","2.2.20-Beta2","2.2.20-RC","2.2.20-RC2","2.2.21","2.2.21-RC","2.2.21-RC2","2.3.0","2.3.0-Beta1","2.3.0-Beta2","2.3.0-RC","2.3.0-RC2","2.3.0-RC3","2.3.10","2.3.10-RC","2.3.10-RC2","2.3.20","2.3.20-Beta1","2.3.20-Beta2","2.3.20-RC","2.3.20-RC2","2.3.20-RC3","2.3.21","2.3.21-RC","2.3.21-RC2","2.4.0","2.4.0-Beta1","2.4.0-Beta2","2.4.0-RC","2.4.0-RC2","2.4.10","2.4.10-RC","2.4.10-RC2"]}],"products":[{"vendor":"jetbrains","product":"kotlin"}],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-53914","tags":["advisory"]},{"url":"https://www.jetbrains.com/privacy-security/issues-fixed","tags":["web"]},{"url":"https://github.com/JetBrains/kotlin/commit/bf51df665b458fda7c3eaf436c4d88dc119d7ec6","tags":["web"]},{"url":"https://github.com/JetBrains/kotlin/releases/tag/v2.4.20-Beta1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r937-wjx7-w2jp"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53914.json","tags":["advisory"]},{"url":"https://github.com/JetBrains/kotlin","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-53914","description":"In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata","status":"published","published":"2026-06-26T13:01:00.434Z","modified":"2026-06-27T03:55:26.966Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-502","CWE-502"],"updated_at":"2026-11-02T14:19:59.761005Z"}],"euvd":[{"id":"EUVD-2026-39659","description":"In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata","status":"published","published":"2026-06-26T13:01:00Z","modified":"2026-06-27T03:55:26Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:23.728044Z"}],"ghsa":[{"id":"GHSA-r937-wjx7-w2jp","title":"JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution","description":"In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata","status":"published","published":"2026-06-26T15:32:13Z","modified":"2026-08-12T19:25:24Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:41:00.097339Z"}],"nvd":[{"id":"CVE-2026-53914","description":"In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata","status":"published","published":"2026-06-26T14:17:05.157Z","modified":"2026-10-25T22:10:00.15Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:26.045561Z"}],"osv":[{"id":"CVE-2026-53914","description":"In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata","status":"published","published":"2026-06-26T13:01:00.434Z","modified":"2026-10-28T02:30:59.117531459Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:45:08.132336Z"},{"id":"GHSA-r937-wjx7-w2jp","title":"JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution","description":"In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata","status":"published","published":"2026-06-26T15:32:13Z","modified":"2026-08-12T19:40:59.256901Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L","level":"medium"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"CLSA-2026-1793139590","title":"TuxCare security update for org.jetbrains.kotlin:kotlin-gradle-plugin (1 CVE)","description":"TuxCare rebuilt org.jetbrains.kotlin:kotlin-gradle-plugin to address 1 CVE. Fixed in 1.9.24-tuxcare.1.","status":"published","published":"2026-10-27T22:19:50Z","modified":"2026-10-30T19:45:48.401607084Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1794245205","title":"TuxCare security update for org.jetbrains.kotlin:kotlin-gradle-plugin (1 CVE)","description":"TuxCare rebuilt org.jetbrains.kotlin:kotlin-gradle-plugin to address 1 CVE. Fixed in 1.9.25-tuxcare.1.","status":"published","published":"2026-11-09T18:26:46Z","modified":"2026-11-10T01:15:03.452716917Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794398674","title":"TuxCare security update for org.jetbrains.kotlin (2 CVEs)","description":"TuxCare rebuilt 2 org.jetbrains.kotlin packages to address 2 CVEs. Fixed in 1.6.0-tuxcare.1.","status":"published","published":"2026-11-11T13:04:35Z","modified":"2026-11-11T19:30:03.687204343Z","updated_at":"2026-11-11T19:50:24.684142Z"}]}}