Gradle vulnerabilities

Products

• Gradle 25
• Enterprise 23
• Build Cache Node 2
• Enterprise Cache Node 2
• Maven 2

Newest

• @nx gradle, maven, nrwl nx +2 more Nx: OS command injection via nx.json plugin options in @nx/maven and @nx/gradle CVE-2026-119282 Fix available 7.3 HighOctober 29, 2026
• gradle gradle-completion gradle-completion has a Bash command injection issue CVE-2026-25063 8.3 HighJanuary 29, 2026
• gradle Gradle's failure to disable repositories failing to answer can expose builds to malicious artifacts CVE-2026-22865 Fix available 8.6 HighJanuary 16, 2026
• gradle Gradle fails to disable repositories which can expose builds to malicious artifacts CVE-2026-22816 Fix available 8.6 HighJanuary 16, 2026
• gradle Gradle vulnerable to local privilege escalation through system temporary directory CVE-2025-27148 Fix available 8.8 HighFebruary 25, 2025
• gradle enterprise Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access... CVE-2025-24858 8.3 HighJanuary 26, 2025
• gradle enterprise Develocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project... CVE-2024-46881 7.1 HighJanuary 26, 2025
• gradle enterprise In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new... CVE-2023-49238 9.8 CriticalJanuary 9, 2024
• gradle Possible local file exfiltration by XML External entity injection CVE-2023-42445 Fix available 6.8 MediumOctober 6, 2023
• gradle Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations CVE-2023-44387 Fix available 3.2 LowOctober 5, 2023
• gradle Dependency cache path traversal in Gradle CVE-2023-35946 Fix available 6.9 MediumJune 30, 2023
• gradle Path traversal vulnerabilities in handling of Tar archives in Gradle CVE-2023-35947 Fix available 6.9 MediumJune 30, 2023
• gradle build action, gradle-build-action +1 more Gradle Build Action data written to GitHub Actions Cache may expose secrets CVE-2023-30853 Fix available 7.6 HighApril 28, 2023
• gradle Gradle usage of long IDs for PGP keys opens potential for collision attacks CVE-2023-26053 Fix available 6.6 MediumMarch 2, 2023
• gradle enterprise A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3... CVE-2022-41575 7.5 HighOctober 21, 2022
• gradle enterprise An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote... CVE-2022-41574 7.5 HighOctober 7, 2022
• gradle Gradle's dependency verification can ignore checksum verification when signature verification cannot be performed CVE-2022-31156 Fix available 6.6 MediumJuly 14, 2022
• gradle enterprise Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information... CVE-2022-30587 7.5 HighJune 6, 2022
• gradle Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution. CVE-2022-30586 Fix available 7.2 HighJune 6, 2022
• gradle enterprise Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not... CVE-2022-27919 9.8 CriticalMarch 25, 2022
• gradle enterprise In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed... CVE-2022-25364 8.1 HighMarch 17, 2022
• gradle enterprise Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It... CVE-2022-27225 6.5 MediumMarch 16, 2022
• gradle Dependency verification bypass in Gradle CVE-2022-23630 Fix available 7.5 HighFebruary 10, 2022
• gradle build cache node, enterprise +1 more In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is... CVE-2021-41589 9.8 CriticalOctober 27, 2021
• gradle enterprise An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code... CVE-2021-41619 7.2 HighOctober 27, 2021
• gradle enterprise In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via... CVE-2021-41590 5.3 MediumOctober 27, 2021
• gradle In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can... CVE-2021-41586 Fix available 7.5 HighSeptember 24, 2021
• gradle In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can... CVE-2021-41587 Fix available 7.5 HighSeptember 24, 2021
• gradle In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary... CVE-2021-41588 Fix available 8.1 HighSeptember 24, 2021
• gradle Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information... CVE-2021-41584 Fix available 7.5 HighSeptember 24, 2021
• gradle Arbitrary code execution via specially crafted environment variables CVE-2021-32751 Fix available 7.5 HighJuly 20, 2021
• gradle, quarkus +1 more Repository content filters do not work in Settings pluginManagement CVE-2021-29427 Public exploitFix available 8.0 HighApril 13, 2021
• gradle, quarkus +1 more Local privilege escalation through system temporary directory CVE-2021-29428 Fix available 8.8 HighApril 13, 2021
• gradle, quarkus +1 more Information disclosure through temporary directory permissions CVE-2021-29429 Fix available 4.0 MediumApril 12, 2021
• gradle maven, enterprise test distribution agent, test distribution +2 more A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent... CVE-2021-26719 6.5 MediumFebruary 9, 2021
• apache ant, fedoraproject fedora, gradle +34 more +36 more Code injection in Apache Ant CVE-2020-11979 Fix available 7.5 HighOctober 1, 2020
• gradle enterprise An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross... CVE-2020-15773 6.5 MediumSeptember 18, 2020
• gradle enterprise An issue was discovered in Gradle Enterprise before 2020.2.5. Lack of the secure attribute on the... CVE-2020-15767 5.3 MediumSeptember 18, 2020
• gradle enterprise An issue was discovered in Gradle Enterprise 2018.5. There is a lack of lock-out after excessive... CVE-2020-15770 5.5 MediumSeptember 18, 2020
• gradle enterprise, enterprise cache node +1 more An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1.... CVE-2020-15771 7.5 HighSeptember 18, 2020
• gradle enterprise An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. There is XXE with resultant SSRF... CVE-2020-15772 4.9 MediumSeptember 18, 2020
• gradle enterprise An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. Because of implicitly remembered... CVE-2020-15774 6.8 MediumSeptember 18, 2020
• gradle enterprise An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. Unrestricted access to a high... CVE-2020-15775 7.5 HighSeptember 18, 2020
• gradle enterprise An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4. CSRF mitigation can be bypassed... CVE-2020-15776 8.8 HighSeptember 18, 2020
• gradle enterprise, enterprise cache node +1 more An issue was discovered in Gradle Enterprise 2017.3 - 2020.2.4 and Gradle Enterprise Build Cache... CVE-2020-15768 7.5 HighSeptember 18, 2020
• gradle enterprise An issue was discovered in Gradle Enterprise 2020.2 - 2020.2.4. An XSS issue exists via the... CVE-2020-15769 6.1 MediumSeptember 18, 2020
• gradle maven Maven Extension plugin for Gradle Enterprise vulnerable to Deserialization of Untrusted Data CVE-2020-15777 Fix available 7.8 HighAugust 25, 2020
• gradle plugin publishing Exposure of Sensitive Information in Gradle publish plugin CVE-2020-7599 Fix available 6.5 MediumMarch 30, 2020
• gradle Use of a weak cryptographic algorithm in Gradle CVE-2019-16370 Fix available 5.9 MediumSeptember 16, 2019
• gradle The HTTP client in the Build tool in Gradle before 5.6 sends authentication credentials... CVE-2019-15052 9.8 CriticalAugust 14, 2019
• Show olderLoading…