EUVD-2026-39659Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 27, 2026
Remote code execution in JetBrains Kotlin before 2.4.20 stems from unsafe deserialization (CWE-502) of build cache metadata, allowing an attacker who can influence cached build artifacts to execute arbitrary code during a build. The flaw carries a CVSS 9.8 (C:H/I:H/A:H) rating, but there is no public exploit identified at time of analysis and EPSS is very low (0.11%, 2nd percentile), and CISA SSVC marks exploitation as 'none'. JetBrains, who reported the issue, has released a fixed version (2.4.20).
Earlier versions of this analysis (2)
Remote code execution in JetBrains Kotlin before 2.4.20 stems from unsafe deserialization of build cache metadata, allowing an attacker who can influence that cache to execute arbitrary code during a build. JetBrains, who reported the issue, has released a fixed version (2.4.20), but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.11%, 2nd percentile). The maximal CVSS 9.8 is driven by the CVSS:3.1/AV:N vector, though real-world exploitation realistically requires the attacker to poison build cache metadata that a victim build then consumes.
Unsafe deserialization of build cache metadata in JetBrains Kotlin before 2.4.20 enables code execution within the build JVM process by an attacker who controls the build cache storage. The CVSS scope change (S:C) signals that successful exploitation can propagate impact beyond the Kotlin toolchain itself to the surrounding CI/CD or developer build environment. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but shared or remote Kotlin build cache deployments represent the highest-risk exposure scenario.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in maven, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Kotlin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Code execution gives full C/I/A, but the attacker must first obtain write/influence over the build cache (PR:L) and meet cache-consumption timing (AC:H), unlike the vendor's PR:N/AC:L.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
Blast Radius
ecosystem impact- 17 maven packages depend on org.jetbrains.kotlin:kotlin-gradle-plugin (13 direct, 4 indirect)
Ecosystem-wide dependent count for version 2.4.20-Beta1.
Executive ViewAI
JetBrains Kotlin versions prior to 2.4.20 contain a critical remote code execution vulnerability in build cache processing that could allow attackers with access to cached build artifacts to execute arbitrary code during application builds. This affects all development teams using affected Kotlin versions and poses a direct risk to build pipeline integrity and deployed software. Despite CVSS 9.8 severity, exploitation likelihood is currently low (EPSS 0.11%) with no identified public exploit code at time of analysis.
Within 24 hours: Conduct inventory of all Kotlin installations and identify projects running versions prior to 2.4.20. Within 7 days: Upgrade all Kotlin installations to version 2.4.20 or later across development and CI/CD environments. Within 30 days: Perform build cache audit covering the past 90 days and validate integrity of all cached artifacts; confirm all active builds complete successfully with patched version.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, pote
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubn
In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Rated high severity (CVSS 8.8)
Cookie scoping bypass in the http4k client-side cookie jar (Maven org.http4k:http4k-core) causes cookies stored by Basic
Replay of captured Digest authentication credentials is possible in the http4k http4k-security-digest module (org.http4k
JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle arti
JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an
Unbounded buffering in the Server-Sent Events parser of the AG-UI Community SDK (Kotlin/Java) lets a malicious or man-in
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects. Rated medi
GitHub PoC
Exploit-DB