CVE-2026-111091

HighCVSS 7.8

Published: 15/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 15/10/2026(UTC)NVD NIST

Summary

JetBrains Junie CLI before version 26.8.3 contains a code execution vulnerability via an untrusted project's MCP server configuration. This may lead to arbitrary code execution in the user's context.

Risk Assessment

The vulnerability may allow an attacker to execute arbitrary code on the user's machine, leading to data theft, malware installation, or further escalation.

Recommendation

Update Junie CLI to version 26.8.3 or later. Avoid opening untrusted projects and verify MCP server configurations.

Other vulnerabilities in JetBrains Junie CLI

CVE-2026-117530Medium
In JetBrains Junie CLI before version 26.8.17, command execution was possible due to incomplete validation of allowlisted commands. The flaw allows bypassing the allowlist mechanism and running unauthorized commands.

Original NVD description (English source)

In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration

Vulnerability data from NVD (NIST) · CISA KEV · EPSS