Gradle fixes code execution flaw in version catalog builds

Gradle has released versions 9.9.1 and 8.14.7 to fix three vulnerabilities in the Gradle build tool, according to Do Son, writing on Daily CyberSecurity on 13 November 2026. The most severe flaw is rated CVSS 9.3 and enables code execution on any machine that builds a project using a crafted version catalog. Gradle states there is a working proof of concept for the attack, but the firm has not published it publicly.

The report notes that the threat hinges on deserialisation or deserialisation-like behavior within the version catalog mechanism, allowing an attacker to run arbitrary code during a build. The article emphasises that the PoC exists in theory or in testing, but there is no publicly available exploit published by the vendor at the time of writing.

The piece also points readers towards tracking CVEs that hit their stack the moment exploitation occurs, and it highlights the importance of monitoring for affected Gradle components and applying the updated versions when feasible. The piece is authored by Do Son of Daily CyberSecurity and includes a note that full threat intelligence coverage is behind a subscription wall.