CVE-2026-53914: JetBrains Kotlin: Unsafe Deserialization in Kotlin Build Cache Enables Code Execution

June 26, 2026 (updated August 12, 2026)

In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata

References

github.com/JetBrains/kotlin/commit/bf51df665b458fda7c3eaf436c4d88dc119d7ec6
github.com/JetBrains/kotlin/releases/tag/v2.4.20-Beta1
github.com/advisories/GHSA-r937-wjx7-w2jp
nvd.nist.gov/vuln/detail/CVE-2026-53914
www.jetbrains.com/privacy-security/issues-fixed

Code Behaviors & Features

Detect and mitigate CVE-2026-53914 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →