SB2026111243 - Multiple vulnerabilities in gradle

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111243

SB2026111243 - Multiple vulnerabilities in gradle

Published: November 12, 2026

Security Bulletin ID SB2026111243
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 33% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Code Injection (CVE-ID: N/A)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code with the build user's privileges and disclose build secrets.

The vulnerability exists due to code injection in Gradle's version catalog accessor generator when catalog values are copied into generated Java source without escaping. A remote attacker can supply crafted versions, dependency coordinates, or plugin ids through a published catalog or untrusted project that a victim loads during a build or IDE synchronization to execute injected code, even if no catalog entries are used.


2) Deserialization of Untrusted Data (CVE-ID: N/A)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose client environment variables and system properties and execute arbitrary code with the victim's privileges.

The vulnerability exists due to deserialization of untrusted data and acceptance of arbitrary daemon addresses in the Gradle client's daemon registry handling when a project selects its own registry through org.gradle.daemon.registry.base. A remote attacker can lure a victim into cloning a crafted repository and running Gradle or opening it in an IDE to redirect requests, expose client data, and deliver crafted Tooling API replies that execute code from an attacker-chosen jar URL.


3) Improper Authentication (CVE-ID: N/A)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 5.4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to steal build credentials, execute code with the victim's privileges, or cause a denial of service.

The vulnerability exists due to missing daemon authentication and stale registry validation in the Gradle client when connecting to a terminated daemon's loopback port. A local user can bind that port before the victim starts a build or IDE synchronization, receive sensitive build data, and return crafted replies that load attacker-chosen code through the Tooling API or trigger command-line deserialization leading to code execution, depending on available classes, or denial of service.


Remediation

Install update from vendor's website.

References