PT-2026-5364 · Gradle · Gradle-Completion

Enrico2 · Published 2026-01-29 · Updated 2026-03-12 · CVE-2026-25063

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions gradle-completion versions prior to 9.3.1

Description gradle-completion offers Bash and Zsh completion support for Gradle. A command injection issue exists in versions up to and including 9.3.0, potentially leading to arbitrary code execution. This occurs when a user triggers Bash tab completion within a project containing a crafted Gradle build file. The Bash completion script inadequately sanitizes Gradle task names and descriptions. Specifically, a malicious Gradle build file can inject commands when the user completes a command in Bash. The issue stems from the script evaluating strings between backticks within task descriptions as commands when displaying the completion list. This does not affect zsh completion. The vulnerability does not require task execution to be triggered.

Recommendations Update to gradle-completion version 9.3.1 or later. As a temporary workaround, remove gradle-completion from .bashrc or .bash profile to disable Bash completion for Gradle.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

CWE-157

Related Identifiers

CVE-2026-25063

GHSA-QGGC-44R3-CJGV

Affected Products

Gradle-Completion

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25063.json · Exploit
• https://github.com/gradle/gradle-completion/commit/ecacc32bb882210e5d37cd79a74de1af0d0ccad7 · Patch
• https://github.com/gradle/gradle-completion/security/advisories/GHSA-qggc-44r3-cjgv · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-25063 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-25063 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-25063 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-25063 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25063 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-25063 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25063 · Security Note
• https://vicarius.io/vsociety/posts/cve-2026-25063-detection-script-command-injection-vulnerability-in-bash-completion-component · Note
• https://t.me/cveNotify/155335 · Telegram Post
• https://t.me/CVEtracker/43257 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2017067931994378307 · Twitter Post
• https://twitter.com/CVEnew/status/2017000651197214770 · Twitter Post