CVE-2026-53914CWE-502

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

Medium · published June 26, 2026

CVSS v3.1
6.7
EPSS
0%
Percentile
25.3
In the wild
Unconfirmed
What it is

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00333 · 25.3th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2026-06-26T13:01Z
EPSS history
Timeline
  • 26 JUN 13:01Z
    In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
    cvelistv5