Command Injection Vulnerability in Gradle Completion by Gradle

CVE-2026-25063

What is CVE-2026-25063?

A command injection vulnerability exists in the gradle-completion tool for Bash, affecting versions up to and including 9.3.0. This flaw emerges when users leverage Bash tab completion in projects that contain malicious Gradle build files. The vulnerability arises from the insufficient sanitization of task names and descriptions, allowing executed commands derived from these task descriptions when users complete a command in Bash. This behavior can lead to unintended code execution, especially if the task description incorporates strings that trigger command evaluation. It's important to note that this vulnerability does not impact zsh completion. The patched version is 9.3.1, and as a mitigation strategy, users can temporarily disable Bash completion for Gradle by editing their .bashrc or .bash_profile files.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References