The vulnerability is an unsafe deserialization flaw in Metabase, allowing an authenticated user who can run native H2 queries to deserialize arbitrary Java objects from H2 native query result columns of type OTHER, which can lead to Remote Code Execution. This weakness follows CWE-502 guidelines.

Affected vendors and product: Metabase. Versions before 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4 are vulnerable when using an H2 database connection, including the default sample database.

The CVSS score of 9.9 signals critical severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires authenticated access with permission to execute native H2 queries; the attacker can trigger code execution on the Metabase server by crafting malicious data in the OTHER output column.