Code Injection in gradle - #VU166060
Published: November 12, 2026
Vulnerability identifier: #VU166060
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code with the build user's privileges and disclose build secrets.
The vulnerability exists due to code injection in Gradle's version catalog accessor generator when catalog values are copied into generated Java source without escaping. A remote attacker can supply crafted versions, dependency coordinates, or plugin ids through a published catalog or untrusted project that a victim loads during a build or IDE synchronization to execute injected code, even if no catalog entries are used.
Affected software
gradle
Remediation
Install security update from vendor's website.
gradle - addressed in versions 8.14.7, 9.9.1