What is GHSA-r937-wjx7-w2jp?

GHSA-r937-wjx7-w2jp is a security advisory published by GitHub Security Advisories with Medium severity. JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution

Which CVE IDs does GHSA-r937-wjx7-w2jp cover?

GHSA-r937-wjx7-w2jp covers the following CVE IDs: CVE-2026-53914. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r937-wjx7-w2jp?

GHSA-r937-wjx7-w2jp has a CVSS v3 base score of 6.7, published by GitHub Security Advisories.

Which products are affected by GHSA-r937-wjx7-w2jp?

GHSA-r937-wjx7-w2jp affects 1 product, including: maven/org.jetbrains.kotlin:kotlin-gradle-plugin:\u003c 2.4.20-Beta1.

GHSA-r937-wjx7-w2jpMediumCVSS 6.7

JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution

Vendor

GitHub Security Advisories

Published

June 26, 2026

Last Modified

August 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-53914 →

📋 Description

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

🎯 Affected products1

maven/org.jetbrains.kotlin:kotlin-gradle-plugin:< 2.4.20-Beta1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-53914
https://www.jetbrains.com/privacy-security/issues-fixed
https://github.com/JetBrains/kotlin/commit/bf51df665b458fda7c3eaf436c4d88dc119d7ec6
https://github.com/JetBrains/kotlin/releases/tag/v2.4.20-Beta1
https://github.com/advisories/GHSA-r937-wjx7-w2jp