Deserialization of Untrusted Data in gradle - #VU162847
Published: November 9, 2026
Vulnerability identifier: #VU162847
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-502
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a low-privileged local attacker to execute code in the Gradle daemon with the privileges of the user running the build.
The vulnerability exists due to unauthenticated Java deserialization on Gradle's loopback worker-to-daemon channel during worker startup. A low-privileged local attacker can win the brief connection race during an actively running build and send a hostile object graph to execute code.
Affected software
gradle
Remediation
Install security update from vendor's website.
gradle - addressed in versions 8.14.6, 9.8.1