MobDev.KotlinGradlePlugin (mob_dev v0.7.31)

Copy Markdown View Source

Detects an Android build still on a Kotlin Gradle plugin (KGP) below 2.4.20, which has CVE-2026-53914 (GHSA-r937-wjx7-w2jp): code execution through unsafe deserialization of Gradle build-cache metadata (MOB-497).

Apps generated by mob_new before its Kotlin 2 migration pin org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.22. The Gradle files are app-owned, so mix mob.doctor reports and never rewrites them (see decisions/2026-08-25-detect-dont-autopatch-native-source.md).

Read from the root, settings and app build scripts (Groovy or Kotlin DSL) and gradle/libs.versions.toml:

  • the org.jetbrains.kotlin:kotlin-gradle-plugin coordinate, or org.jetbrains.kotlin:compose-compiler-gradle-plugin (whose POM requires KGP at the same version), with a literal version, a $var resolved from an assignment in the same file, or a strictly/require/prefer block;
  • the plugin ids that resolve to KGP or pin it (org.jetbrains.kotlin. android, jvm, multiplatform, kapt, js, native.cocoapods, android.extensions, plugin.compose, plugin.parcelize, and the kotlin("…") shorthand) with a version;
  • catalog [libraries] and [plugins] entries for any of them, with version = "…" or version.ref resolved through [versions].

Only those count. Other Kotlin plugins (serialization), look-alike artifacts (kotlin-gradle-plugin-api), a kotlin catalog key that nothing above references, and commented-out lines are ignored. A version that can't be resolved to a literal (version kotlinVersion, an unknown $var) still declares KGP but is never guessed: doctor only warns, so a false positive would tell a fixed app it is still exposed every time it runs.

AGP 9 compiles Kotlin itself and depends on KGP 2.2.10 at runtime, so an AGP 9 build that declares no KGP at all is on 2.2.10 and is reported too.

Summary

Types

finding()

A reason to warn, with the project-relative file it was read from.

Functions

below_fix?(version)

True when version is a parseable version below the CVE-2026-53914 fix.

check(root)

The findings for the Android project under root, sorted by file. [] when every declared KGP is at or above 2.4.20 (or there is no Android build to read).

Types

finding()

@type finding() ::
  {:vulnerable, Path.t(), [String.t()]}
  | {:builtin_kotlin_unpinned, Path.t(), String.t()}

A reason to warn, with the project-relative file it was read from.

Functions

below_fix?(version)

@spec below_fix?(String.t()) :: boolean()

True when version is a parseable version below the CVE-2026-53914 fix.

check(root)

@spec check(Path.t()) :: [finding()]

The findings for the Android project under root, sorted by file. [] when every declared KGP is at or above 2.4.20 (or there is no Android build to read).