The vulnerability arises from deserializing untrusted build cache metadata in JetBrains Kotlin version 2.4.20 and earlier. This can lead to arbitrary code execution. The weakness is a deserialization flaw (CWE-502). Attackers that can introduce malicious metadata into the build cache can trigger code execution during normal build operations.

JetBrains Kotlin binaries before version 2.4.20 are affected. Users of the Kotlin compiler and tools that rely on the build cache—such as integrated development environments or continuous integration pipelines—may be susceptible. Version 2.4.20 and later contain the fix.

The CVSS score of 6.7 indicates a moderate severity. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, there is no known large-scale exploitation activity. However, the vulnerability requires the ability to place malicious metadata in the cache; if the build environment is shared or the cache is network‑accessible, this could be an attack vector. Users should consider the risk as moderate and address it promptly.