ObjectSocketWrapper.java in Gradle 2.12 allows remote malicious users to execute arbitrary code via a crafted serialized object.
gradle gradle 2.12