Gradle versions prior to 9.3.0 did not treat certain dependency‑resolution exceptions as fatal, allowing the build process to continue to subsequent repositories. An unresolvable host name or a repository that throws an exception could be exploited by an attacker who registers a domain matching the build’s repository name to supply malicious artifacts. The victim build would then incorporate these artifacts, potentially leading to remote code execution or the introduction of compromised binaries into released products.

The vulnerability affects Gradle Gradle, the Java build automation tool, in all releases prior to 9.3.0. Any project configuration that specifies one or more remote repositories and does not disable faulty repositories on error is susceptible.

The CVSS score of 8.6 indicates a high severity risk, but the EPSS score of less than 1% suggests that the probability of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to know the build’s repository list and ensure their rogue host appears early in that list, so the exploit is feasible but requires targeted preparation. Damage can range from malicious code insertion to supply‑chain compromise depending on the artifact content.