In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata
CWE-502, CWE-502