jetbrains/kotlin
master@ b143655Fixes14
CVEs7
Peak severityHigh
Commits140,540
Regression coverage35.7%
Highlights
Path Traversal: 4 prior fixes. Scrutinize any change in this area.
libraries/stdlib/jdk7/src/kotlin/io/path/PathRecursiveFunctions.kt: most-fixed (2 issues). Treat as high-risk during review.
8 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
Path Traversal: Multiple archive extraction and path resolution functions lacked canonicalization and containment checks, allowing writes outside target directories via symlinks or '..' sequences.
Insecure Deserialization: KAPT incremental caches were deserialized with unrestricted ObjectInputStream, enabling gadget attacks. Fixes added class whitelists/allowlists but may not cover all cache loaders.
Insecure Temporary File: Legacy temp file creation (Guava createTempDir, unsafe Files APIs) led to predictable paths and symlink attacks, as reflected in CVE-2020-29582 and CVE-2020-15824.
Last analyzed 31 Aug 2026, 07:54 UTC