CVE-2026-111091: CWE-829 in JetBrains Junie CLI

JetBrains Junie CLI versions prior to 26.8.3 contain a vulnerability (CWE-829) that enables code execution via an untrusted project's MCP server configuration. This occurs because the software improperly handles or trusts configuration elements from external projects, allowing an attacker to execute arbitrary code. The CVSS 3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to full code execution on the affected system, compromising confidentiality, integrity, and availability of the environment where Junie CLI is used. The attack requires local access and user interaction but no privileges, making it a significant risk if an attacker can trick a user into opening a malicious project configuration.

A fix is available in JetBrains Junie CLI version 26.8.3 and later. Users should upgrade to version 26.8.3 or newer to remediate this vulnerability. Since no vendor advisory or patch links are provided, verify the availability of the fix from official JetBrains sources before upgrading. Until patched, avoid opening untrusted project configurations to reduce risk.