JetBrains Kotlin vulnerabilities

7 CVEs affecting JetBrains Kotlin, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-53914, published 2026-06-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-29582, published 2021-02-03. Medium severity, CVSS 5.3. EPSS: 2.6% chance of exploitation in the next 30 days. In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure…
CVE-2022-24329, published 2022-02-25. Medium severity, CVSS 5.3. EPSS: 2.2% chance of exploitation in the next 30 days. In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
CVE-2020-15824, published 2020-08-08. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts…
CVE-2019-10101, published 2019-07-03. High severity, CVSS 8.1. EPSS: 1.4% chance of exploitation in the next 30 days. JetBrains Kotlin versions before 1.3.30 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack.
CVE-2019-10102, published 2019-07-03. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. JetBrains Ktor framework (created using the Kotlin IDE template) versions before 1.1.0 were resolving artifacts using an http connection during the build process, potentially allowing an MITM attack.…
CVE-2019-10103, published 2019-07-03. High severity, CVSS 8.1. EPSS: 0.8% chance of exploitation in the next 30 days. JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/JVM Server) IDE Template were resolving Gradle artifacts using an http connection, potentially allowing an MITM attack. This…
CVE-2026-53914, published 2026-06-26. Critical severity, CVSS 9.8. EPSS: 0.3% chance of exploitation in the next 30 days. In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata