CVE-2026-25063
Command Injection in Gradle-Completion Bash Leads to Code Execution
Publication date: 2026-01-29
Last updated on: 2026-03-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gradle | gradle-completion | to 9.3.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-157 | The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in gradle-completion up to version 9.3.0, which provides Bash and Zsh completion support for Gradle. Specifically, the Bash completion script fails to properly sanitize Gradle task names and descriptions. If a malicious Gradle build file contains task descriptions with strings enclosed in backticks, those strings are executed as commands when a user triggers Bash tab completion. This allows an attacker to execute arbitrary code without the user explicitly running any Gradle task. The vulnerability does not affect Zsh completion and was fixed in version 9.3.1.
How can this vulnerability impact me? :
This vulnerability can lead to arbitrary code execution on your system when you use Bash tab completion in a Gradle project containing a malicious build file. An attacker could exploit this to run unauthorized commands with the privileges of the user triggering the completion, potentially compromising your system or data. Since the vulnerability triggers without explicit task execution, it can be exploited simply by attempting to complete commands in Bash.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, you can disable Bash completion for Gradle by removing the gradle-completion script from your .bashrc or .bash_profile files. Additionally, upgrading gradle-completion to version 9.3.1 or later will patch the vulnerability.