Medium · 6.7 CVE-2026-53914 EUVD-2026-39659GHSA-r937-wjx7-w2jp

JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution

Published Jun 26, 2026 · Updated Jun 27, 2026 · Assigned by JetBrains

Description

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

Vendor	Product	Affected	Fixed
JetBrains	Kotlin	< 2.4.20	2.4.20

Ecosystem	Package	Affected	Fixed	Record
Maven	org.jetbrains.kotlin:kotlin-gradle-plugin	< 2.4.20-Beta1	2.4.20-Beta1	GHSA-r937-wjx7-w2jp