CVE-2026-53914 is an unsafe deserialization flaw (CWE-502) in JetBrains Kotlin before version 2.4.20, in the build cache metadata. The record says code execution was possible and scores it 6.7 medium. Upgrade to Kotlin 2.4.20 or later and limit who can write to your build cache.
What's affected
JetBrains Kotlin before 2.4.20, per the CVE record. The fixed version is 2.4.20.
The record gives few details beyond the cause. JetBrains lists it on its fixed issues page, which loads dynamically, so read that page for the exact component.
The vector is local with high complexity and high privileges required, which fits a build environment where an attacker can place data in a cache.
How to check if you're exposed
Find your Kotlin version. In a Gradle project:
./gradlew dependencies --configuration kotlinCompilerClasspath | grep kotlin-compiler
Also check the plugin line in your build files, for example kotlin("jvm") version. Anything below 2.4.20 is affected. Check CI images and shared build machines, which often lag behind laptops.
You can also run the free in-browser dependency scan or browse the Gold directory to see where this component shows up in your stack.
What to do now
- List projects and CI images by Kotlin version.
- Upgrade to Kotlin 2.4.20 or later.
- Restrict write access to shared or remote build caches to trusted build jobs only.
- Clear caches that untrusted contributors or jobs could have written to.
- Read the JetBrains fixed issues page for further guidance.
Why it matters
Deserialization turns stored bytes back into objects. When the bytes can be influenced by someone else, the process loading them may run code of that person's choosing. This is CWE-502, deserialization of untrusted data.
The lesson for build teams is that a cache is an input. If pull request builds can write to a cache that trusted builds read, the cache is a path for untrusted data. The record does not report exploitation, and the CVE is not in the CISA KEV catalog. The low score reflects the local and privileged conditions, not a lack of care needed.
Quick check
How much detail is public?
Little. The record gives the cause and the fixed version only.
Do I need to worry about developer laptops?
The conditions are local and privileged. Shared CI caches are the higher risk.
Sources
Last reviewed: 19 October 2026.
