Threat database

In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server

CVE-2026-123855 is a high-severity OS command injection vulnerability in JetBrains Toolbox App versions before 3.6.1. The flaw allows command injection via enterprise configuration URLs. It was fixed in version 3.6.1.

In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module

CVE-2026-123853 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows code execution in Safe Mode via project-controlled JVM options of the build process. The flaw is due to inclusion of functionality from an untrusted control sphere (CWE-829).

CVE-2026-123852 is a high-severity vulnerability in JetBrains Junie GitHub Action versions before 1.8.0. It involves incorrect authorization (CWE-863) that allows code execution with workflow credentials via fork updates. The issue is fixed in version 1.8.0.

In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters

In JetBrains YouTrack before 2026.2.19422 cSS injection was possible in Mermaid diagrams via configuration directives

CVE-2026-123849 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows code execution in untrusted projects via the Terraform File Watchers feature. The flaw is classified under CWE-829, which involves inclusion of functionality from an untrusted control sphere. This vulnerability has been fixed in version 2026.3.

CVE-2026-123848 is a vulnerability in JetBrains IntelliJ IDEA prior to version 2026.3 where host name verification was missing for server TLS certificates. This improper validation of certificates (CWE-297) could allow an attacker to present a TLS certificate that does not match the server's host name, potentially enabling man-in-the-middle attacks. The issue has been fixed in version 2026.3.

In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion

In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation

In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects

In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories

In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration

CVE-2026-123842 is a vulnerability in JetBrains IntelliJ IDEA before version 2026.3 that allows arbitrary file write via symbolic links when extracting plugin archives. This flaw is due to improper handling of symlinks during plugin extraction. The issue is fixed in version 2026.3.

CVE-2026-123841 is a vulnerability in JetBrains IntelliJ IDEA prior to version 2026.3 that allows code execution via symbolic links in an imported settings archive. This flaw is related to improper handling of symlinks (CWE-59) during the import process. The vulnerability has a high severity with a CVSS score of 7.8 and was fixed in version 2026.3.

In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs

In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model

CVE-2026-123838 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.3. It allows code execution in Safe Mode via a UI Designer form file due to inclusion of functionality from an untrusted control sphere (CWE-829). This flaw is fixed in version 2026.3.

CVE-2026-123837 is an OS command injection vulnerability in JetBrains IntelliJ IDEA versions before 2026.3 and 2026.2.1. The flaw allows command injection via Tomcat run configurations on Windows Subsystem for Linux (WSL) when working with untrusted projects. This vulnerability has a high severity with a CVSS score of 7.8, impacting confidentiality, integrity, and availability. A fix is available in version 2026.3.