CVE Intelligence
Analysis AI-assisted

CVE-2026-53914: JetBrains Kotlin Unsafe Deserialization in Build Cache Metadata

JetBrains Kotlin versions before 2.4.20 are affected by an unsafe deserialization weakness (CWE-502) in build cache metadata, which according to the record can allow code execution. NVD rates the issue Critical with a CVSS 3.1 base score of 9.8, while the CNA JetBrains lists 6.7. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

JetBrains Kotlin versions before 2.4.20 contain an unsafe deserialization weakness (CWE-502) in build cache metadata. According to the record, this made code execution possible. The issue is described in the CVE record and in the vendor's issues-fixed page.

Impact

  • NVD assigns a CVSS 3.1 base score of 9.8 (Critical), with network attack vector, low complexity, no privileges required and no user interaction, and high impact on confidentiality, integrity and availability.
  • The CNA JetBrains lists a separate CVSS 3.1 score of 6.7 in the record.
  • The real impact in a given build environment depends on how build cache data is produced and consumed, which the sources do not detail.

Affected products and versions

  • Product: JetBrains Kotlin.
  • Affected range: versions before 2.4.20 (listed as < 2.4.20).
  • The record contains no explicit fixed-version field. The 2.4.20 boundary suggests a fix in that release, but this is an inference to confirm with the vendor.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Inventory projects and build tooling that use Kotlin and identify versions below 2.4.20.
  • Upgrade to 2.4.20 or later, following the vendor guidance in the JetBrains issues-fixed page.
  • Until upgrades are complete, restrict who and what can write to shared build caches, and treat cache content from untrusted sources as untrusted.

Detection guidance

  • Review build logs for unexpected processes or unfamiliar artifacts produced during cache operations.
  • Monitor build agents for unexpected outbound connections or new files created during builds.
  • Review access logs for shared build cache storage for unusual writers.

Limitations of the available information

  • The record gives no technical details of the deserialization path and no explicit fixed-version field.
  • EPSS and SSVC data are not available in the record.
  • The two CVSS scores differ, and both are reported as provided by their respective sources.

Frequently asked questions

Which versions of JetBrains Kotlin are affected by CVE-2026-53914?

The record lists versions before 2.4.20 as affected. It does not list an explicit fixed version, so verify the fix with the vendor advisory.

Is CVE-2026-53914 being actively exploited?

The record does not list this CVE in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Why are there two CVSS scores for this CVE?

NVD reports a CVSS 3.1 score of 9.8, while the CNA JetBrains reports a CVSS 3.1 score of 6.7. Both are shown as provided by their sources.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.