JetBrains Junie CLI versions prior to 26.6.29 exposed sensitive environment variables in session event logs. This exposure could allow local users with limited privileges to access confidential information stored in environment variables. The vulnerability has a medium severity rating with a CVSS score of 5.5.
A command execution vulnerability exists in JetBrains Junie CLI versions prior to 26.8.24 via the Allow Similar Commands option. This flaw allows an attacker with local access to execute commands, potentially leading to high impact on confidentiality, integrity, and availability.
A path traversal vulnerability exists in JetBrains IntelliJ IDEA versions before 2026.3. This flaw allows an attacker to exploit the unpacking process of Dev Container archives obtained from a remote host, potentially leading to unauthorized file system access.
A vulnerability in JetBrains IntelliJ IDEA versions before 2026.3 allows improper checks that could enable disabled plugins via external dependency settings. This issue could lead to the unintended activation of plugins that were meant to be disabled.
A vulnerability in JetBrains IntelliJ IDEA before version 2026.3 allows code execution via document import in untrusted projects. This flaw could enable an attacker to execute arbitrary code when importing documents in projects that are not trusted by the user.
A vulnerability in JetBrains IntelliJ IDEA before version 2026.3 allows Kotlin scripts in untrusted projects to trigger dependency downloads from arbitrary repositories. This could lead to unintended network activity and potential exposure to malicious dependencies.
JetBrains IntelliJ IDEA versions before 2026.3 contain a vulnerability where improper checks allow server certificates to be added to the trust store during headless runs. This flaw could lead to unauthorized trust of malicious certificates.
JetBrains IntelliJ IDEA versions before 2026.3 and 2026.2.4 are vulnerable to an XML External Entity (XXE) attack via an XML response to an HTTP Client request. This vulnerability allows an attacker to potentially exploit XML parsing to access unauthorized data. The CVSS score is low, indicating limited impact, primarily confidentiality loss without integrity or availability impact.
A vulnerability in JetBrains IntelliJ IDEA before version 2026.3 allows code execution in untrusted projects via a configured ShellCheck path. This flaw can lead to high impact on confidentiality, integrity, and availability.
A stored cross-site scripting (XSS) vulnerability exists in JetBrains IntelliJ IDEA versions before 2026.3 and 2026.2.4. The vulnerability occurs on the built-in web server through the Markdown preview feature, potentially allowing an attacker to inject malicious scripts that execute in the context of the affected application.
A vulnerability in JetBrains IntelliJ IDEA before versions 2026.3 and 2026.2.4 allows command execution via a hidden run control in the Markdown preview feature. The flaw permits an attacker to execute commands with limited privileges, requiring local access and user interaction. The vulnerability has a medium severity rating with a CVSS score of 5.3.
A vulnerability in JetBrains IntelliJ IDEA versions before 2026.3 and 2026.2.4 allows unauthenticated connections to arbitrary hosts via run configurations. This flaw could lead to high confidentiality and integrity impact but does not affect availability.
A Server-Side Request Forgery (sSRF) vulnerability exists in JetBrains IntelliJ IDEA versions before 2026.3 and 2026.2.4. The vulnerability can be triggered via specially crafted annotations.xml files during the indexing process. The CVSS score is low, indicating limited impact primarily on confidentiality with no integrity or availability impact.
A DOM-based cross-site scripting (XSS) vulnerability exists in JetBrains IntelliJ IDEA versions before 2026.3 in the OpenAPI preview error view. This vulnerability could allow an attacker to execute arbitrary code in the context of the affected application. The flaw is identified as CVE-2026-123301 and has a high severity rating.
A vulnerability in JetBrains Hub versions before 2026.2.52519 allowed bypassing two-factor authentication via the password reset flow. This issue could enable an attacker to circumvent the second authentication factor, potentially gaining unauthorized access. The vulnerability has a CVSS score of 6.8, indicating a medium severity. No specific affected versions are listed, and no patch information is provided in the source data.
A command injection vulnerability in the SMTP email verification functionality of JetBrains Hub versions prior to 2026.2.52556 allows an attacker with limited privileges to inject SMTP commands. This flaw does not impact confidentiality or availability but can lead to integrity issues.
A code execution vulnerability exists in JetBrains IntelliJ IDEA versions before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2. This flaw allows code execution in untrusted projects via script engine discovery. The vulnerability has a high severity rating with a CVSS score of 7.8.
A low-severity information disclosure vulnerability exists in JetBrains Hub versions before 2026.2.52519. The flaw allows unauthorized information disclosure via user search queries.
A vulnerability in JetBrains Hub versions before 2026.2.52519 allowed users with read-only access to modify authentication module group mappings due to missing authorization checks. This flaw could lead to unauthorized integrity impact without affecting confidentiality or availability.
JetBrains Datalore versions prior to 2026.4 have a vulnerability where API tokens and sessions for users who have been removed or banned remain valid. This could allow continued access by unauthorized users after account removal or banning.