Gradle
19 CVEs across 12 Gradle products. Browse Gradle vulnerabilities, severities, and proof-of-concept exploits.
Gradle products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25063 | High | 7.8 | 2026-01-29 | gradle-completion provides Bash and Zsh completion support for Gradle. A command injection vulnerability was found in gradle-completion up to and including 9.3… |
CVE-2026-22865 | High | 7.4 | 2026-01-16 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, s… |
CVE-2026-22816 | High | 7.4 | 2026-01-16 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. When resolving dependencies in versions before 9.3.0, s… |
CVE-2025-27148 | High | 8.8 | 2025-02-25 | Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system temporary directory ca… |
CVE-2024-46881 | High | 7.1 | 2025-01-26 | Develocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise C… |
CVE-2025-24858 | | 2025-01-26 | Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the s… | |
CVE-2023-49238 | Critical | 9.8 | 2024-01-09 | In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-uni… |
CVE-2023-42445 | Medium | 6.8 | 2023-10-06 | Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML… |
CVE-2023-44387 | Low | 3.2 | 2023-10-05 | Gradle is a build tool with a focus on build automation and support for multi-language development. When copying or archiving symlinked files, Gradle resolves… |
CVE-2023-35947 | Medium | 6.9 | 2023-06-30 | Gradle is a build tool with a focus on build automation and support for multi-language development. In affected versions when unpacking Tar archives, Gradle di… |
CVE-2023-35946 | Medium | 6.9 | 2023-06-30 | Gradle is a build tool with a focus on build automation and support for multi-language development. When Gradle writes a dependency into its dependency cache… |
CVE-2023-30853 | High | 7.6 | 2023-04-28 | Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using the Gradle Build Ac… |
CVE-2023-26053 | Medium | 6.6 | 2023-03-02 | Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP key… |
CVE-2022-41575 | High | 7.5 | 2022-10-21 | A credential-exposure vulnerability in the support-bundle mechanism in Gradle Enterprise 2022.3 through 2022.3.3 allows remote attackers to access a subset of… |
CVE-2022-41574 | High | 7.5 | 2022-10-07 | An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with ar… |
CVE-2022-31156 | Medium | 6.6 | 2022-07-14 | Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies eit… |
CVE-2022-30587 | High | 7.5 | 2022-06-06 | Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure. |
CVE-2022-30586 | High | 7.2 | 2022-06-06 | Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution. |
CVE-2022-27919 | Critical | 9.8 | 2022-03-25 | Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allow… |
CVE-2022-25364 | High | 8.1 | 2022-03-17 | In Gradle Enterprise before 2021.4.2, the default built-in build cache configuration allowed anonymous write access. If this was not manually changed, a malici… |
CVE-2022-27225 | Medium | 6.5 | 2022-03-16 | Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-… |
CVE-2022-23630 | High | 7.5 | 2022-02-10 | Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept… |
CVE-2021-41619 | High | 7.2 | 2021-10-27 | An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuration. The installat… |
CVE-2021-41590 | Medium | 5.3 | 2021-10-27 | In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test. The installation configuration us… |
CVE-2021-41589 | Critical | 9.8 | 2021-10-27 | In Gradle Enterprise before 2021.3 (and Enterprise Build Cache Node before 10.0), there is potential cache poisoning and remote code execution when running the… |
CVE-2021-41588 | High | 8.1 | 2021-09-24 | In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and… |
CVE-2021-41587 | High | 7.5 | 2021-09-24 | In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources. |
CVE-2021-41586 | High | 7.5 | 2021-09-24 | In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password. |
CVE-2021-41584 | High | 7.5 | 2021-09-24 | Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a… |
CVE-2021-32751 | High | 7.5 | 2021-07-20 | Gradle is a build tool with a focus on build automation. In versions prior to 7.2, start scripts generated by the `application` plugin and the `gradlew` script… |
CVE-2021-29428 | High | 8.8 | 2021-04-13 | In Gradle before version 7.0, on Unix-like systems, the system temporary directory can be created with open permissions that allow multiple users to create and… |
CVE-2021-29427 | High | 8.0 | 2021-04-13 | In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository con… |
CVE-2021-29429 | Medium | 4.0 | 2021-04-12 | In Gradle before version 7.0, files created with open permissions in the system temporary directory can allow an attacker to access information downloaded by G… |
CVE-2021-26719 | Medium | 6.5 | 2021-02-09 | A directory traversal issue was discovered in Gradle gradle-enterprise-test-distribution-agent before 1.3.2, test-distribution-gradle-plugin before 1.3.2, and… |
CVE-2020-11979 | High | 7.5 | 2020-10-01 | As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access the… |
CVE-2020-15773 | Medium | 6.5 | 2020-09-18 | An issue was discovered in Gradle Enterprise before 2020.2.4. Because of unrestricted cross-origin requests to read-only data in the Export API, an attacker ca… |
CVE-2020-15776 | High | 8.8 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4. The CSRF prevention token is stored in a request cookie that is not annotated as HttpOnly. An a… |
CVE-2020-15775 | High | 7.5 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2017.1 - 2020.2.4. The /usage page of Gradle Enterprise conveys high level build information such as project names… |
CVE-2020-15774 | Medium | 6.8 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. An attacker with physical access to the browser of a user who has recently logged in to Gradle… |
CVE-2020-15772 | Medium | 4.9 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2018.5 - 2020.2.4. When configuring Gradle Enterprise to integrate with a SAML identity provider, an XML metadata… |
CVE-2020-15771 | High | 7.5 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2018.2 and Gradle Enterprise Build Cache Node 4.1. Cross-site transmission of cookie containing CSRF token allows… |
CVE-2020-15770 | Medium | 5.5 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2018.5. An attacker can potentially make repeated attempts to guess a local user's password, due to lack of lock-o… |
CVE-2020-15769 | Medium | 6.1 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2020.2 - 2020.2.4. An XSS issue exists via the request URL. |
CVE-2020-15768 | High | 7.5 | 2020-09-18 | An issue was discovered in Gradle Enterprise 2017.3 - 2020.2.4 and Gradle Enterprise Build Cache Node 1.0 - 9.2. Unrestricted HTTP header reflection in Gradle… |
CVE-2020-15767 | Medium | 5.3 | 2020-09-18 | An issue was discovered in Gradle Enterprise before 2020.2.5. The cookie used to convey the CSRF prevention token is not annotated with the “secure” attribute… |
CVE-2020-15777 | High | 7.8 | 2020-08-25 | An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects… |
CVE-2020-7599 | Medium | 6.5 | 2020-03-30 | All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gr… |
CVE-2019-16370 | Medium | 5.9 | 2019-09-16 | The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has t… |
CVE-2019-15052 | Critical | 9.8 | 2019-08-14 | The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect, Gradle… |
CVE-2019-11403 | Critical | 9.8 | 2019-04-22 | In Gradle Enterprise before 2018.5.2, Build Cache Nodes would reflect the configured password back when viewing the HTML page source of the settings page. |
CVE-2019-11402 | Critical | 9.8 | 2019-04-22 | In Gradle Enterprise before 2018.5.3, Build Cache Nodes did not store the credentials at rest in an encrypted format. |
CVE-2019-11065 | Medium | 5.9 | 2019-04-10 | Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Depen… |
CVE-2016-6199 | Critical | 9.8 | 2017-02-07 | ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object. |