CVE-2026-111091

7.8High

Published 15 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.8High

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required
Impact: Full C/I/A compromise
Weakness: CWE-829

Impact

Attackers can execute arbitrary code on a user's machine if the user opens or runs Junie CLI against an untrusted project. The attacker needs to trick the user into loading a malicious MCP server configuration file.

Root cause

The CLI unsafely includes and executes code or server configurations from untrusted project-level MCP settings.

Affected systems

JetBrains Junie CLI before 26.8.3

CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade JetBrains Junie CLI to version 26.8.3 or later. If patching immediately is not possible, do not open untrusted repositories or run Junie CLI in unverified directories.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Source: nvd.nist.gov/vuln/detail/CVE-2026-111091