Deserialization of Untrusted Data in gradle - #VU162846
Published: November 9, 2026
Vulnerability identifier: #VU162846
CSH Severity: Medium
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-502
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged local attacker to execute code with the build user's privileges or cause denial of service.
The vulnerability exists due to the Gradle daemon deserializing untrusted Java objects before verifying the authentication token on its loopback client communication channel. A low-privileged local attacker can send a malicious serialized object graph to a running daemon to trigger exploitation, even when no build is active.
Affected software
gradle
Remediation
Install security update from vendor's website.
gradle - addressed in versions 8.14.6, 9.8.1