Deserialization of Untrusted Data in gradle - #VU166061
Published: November 12, 2026
Vulnerability identifier: #VU166061
CSH Severity: Medium
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-502
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose client environment variables and system properties and execute arbitrary code with the victim's privileges.
The vulnerability exists due to deserialization of untrusted data and acceptance of arbitrary daemon addresses in the Gradle client's daemon registry handling when a project selects its own registry through org.gradle.daemon.registry.base. A remote attacker can lure a victim into cloning a crafted repository and running Gradle or opening it in an IDE to redirect requests, expose client data, and deliver crafted Tooling API replies that execute code from an attacker-chosen jar URL.
Affected software
gradle
Remediation
Install security update from vendor's website.
gradle - addressed in versions 8.14.7, 9.9.1