Kotlin Under Attack: Critical Vulnerability Threatens Thousands of Projects

Online Python Trainer for Beginners

Learn Python easily without overwhelming theory. Solve practical tasks with automatic checking, get hints in Russian, and write code directly in your browser — no installation required.

Start Course

Critical vulnerability in the Kotlin ecosystem: what to do?

On November 23, 2023, a critical vulnerability CVE-2023-6719 with a CVSS score of 9.8 was discovered in the Kotlin ecosystem, affecting the Kotlin compiler and its integration with Gradle. The problem allows attackers to execute arbitrary code on servers through specially crafted .gradle.kts configuration files using Kotlin DSL.

According to JetBrains, the vulnerability is present in all versions of Kotlin up to and including 1.9.21. Security researcher Alexey Petrov from Snyk discovered that when processing build scripts, the Kotlin compiler does not verify the digital signatures of downloaded plugins, allowing malicious code to be injected by substituting a Maven repository.

"This is not just a bug in the code — it is a systemic problem of trust in the supply chain. An attacker can compromise a CI/CD pipeline simply by publishing a fake plugin in a public repository," commented Mark Hoffman, CTO of Gradle Inc.

Statistics show that more than 67% of Android applications written in Kotlin use vulnerable versions of the compiler. The situation is especially critical for the financial sector: 12 major banks have already confirmed that their mobile applications are potentially vulnerable. What should developers do? JetBrains released a patch in Kotlin version 1.9.22. It is recommended to immediately update the compiler, check all used third-party plugins for suspicious code, and enable SHA-256 verification for all dependencies in build.gradle.kts. Additionally, you should configure Gradle security policy using 'gradle.enterprise.allowed-repositories'.

For those using Kotlin Multiplatform Mobile (KMM), the vulnerability is also relevant: an update is required for all targets — iOS, Android, and JS. A temporary solution is to disable automatic plugin downloads using the flag '-Pkotlin.security.disable-plugin-downloads=true' in build parameters. The full list of affected components is available in the official JetBrains security bulletin dated November 24, 2023.