Critical Code Execution Vulnerability in Gradle Version Catalog Fixed in Versions 9.9.1 and 8.14.7
Gradle addressed three vulnerabilities in its build tool with the release of versions 9.9.1 and 8.14.7. The most severe flaw is a critical vulnerability (CVSS 9.3) that allows a crafted version catalog to execute code on any machine performing the build of the project. Gradle confirmed there is a working proof of concept but has not published it. Users of affected Gradle versions should update to the fixed releases to mitigate this critical risk.
Entenda a falha
A vulnerabilidade
Gradle fixed three vulnerabilities in its build tool in versions 9.9.1 and 8.14.7. The most severe is rated critical (CVSS 9.3) and sits in the version catalog feature: a crafted version catalog can run code on any machine that builds the project. The articles give no CVE ID, no authentication or configuration requirements, and no details on the other two flaws. The fixed releases are 9.9.1 and 8.14.7.
Como foi descoberta
The articles do not say who found the flaw or how. They only report that Gradle disclosed the three vulnerabilities with the release of versions 9.9.1 and 8.14.7.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Gradle says it has a working proof of concept for the critical version catalog flaw but has not published it. The articles give no further detail on how it works. Since a working exploit exists, even if private, update to 9.9.1 or 8.14.7 promptly, especially on machines that build projects with version catalogs from untrusted sources.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 23:16.
Linha do tempo
-
Critical Code Execution Vulnerability in Gradle Version Catalog Fixed in Versions 9.9.1 and 8.14.7
ler a análise desta fonte ocultar
Gradle addressed three vulnerabilities in its build tool with the release of versions 9.9.1 and 8.14.7. The most severe flaw is a critical vulnerability (CVSS 9.3) that allows a crafted version catalog to execute code on any machine performing the build of the project. Gradle confirmed there is a working proof of concept but has not published it. Users of affected Gradle versions should update to the fixed releases to mitigate this critical risk.