CVE-2026-41153: JetBrains Junie Command Injection via Malicious Project File
CVE-2026-41153 affects JetBrains Junie versions before 252.549.29, where a malicious project file can lead to command execution, classified as CWE-77 (Command Injection). NVD scores it 9.8 (critical) under a CVSS vector with network attack vector, no privileges and no user interaction required. The record shows no KEV listing and no confirmed exploitation in the sources consulted.
Overview
CVE-2026-41153 is a command injection issue in JetBrains Junie. According to the record, command execution was possible through a malicious project file in versions before 252.549.29. The weakness is classified as CWE-77.
Impact
NVD assigns a base score of 9.8 (critical). The NVD vector describes a network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity and availability. JetBrains lists a separate score of 5.8 for the same CVE in its own data. The two scores differ, and the record does not explain the difference.
Affected products and versions
- Product: JetBrains Junie
- Affected range: before 252.549.29
- Fixed version: 252.549.29, which is the endpoint of the affected range in the record. The record's fix list is empty, so the vendor page is the place to confirm the exact fixed build.
Exploitation status
CISA KEV does not list this CVE. The EPSS probability is 0.00351 (percentile 0.27545). SSVC data in the record marks exploitation as none and automatable as no. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Update JetBrains Junie to version 252.549.29 or later, following the vendor advisory at JetBrains issues fixed.
- Until the update is applied, avoid opening project files from untrusted sources in affected installations.
- Review IDE and assistant settings that allow automatic actions on project content, and restrict them where possible.
Detection guidance
- Watch for unexpected child processes launched by the IDE or its assistant components.
- Review changes to shared project configuration files in version control, especially those introduced by external contributors.
- Keep an inventory of Junie installations so that patch status can be verified.
Limitations of the available information
The record does not describe the exact malicious project file structure, the specific injection point, or the commands that could be run. It does not list the affected platforms or whether other JetBrains products are involved. The fixed-version list in the record is empty, and the CVSS scores from NVD and JetBrains differ.
Frequently asked questions
Which JetBrains Junie versions are affected by CVE-2026-41153?
According to the record, versions before 252.549.29 are affected. Upgrading to 252.549.29 or later is the recommended action, as stated in the vendor advisory.
Is CVE-2026-41153 known to be actively exploited?
The record shows no KEV listing for this CVE, and no confirmed exploitation appears in the sources consulted. Patching should still be treated as a priority given the critical NVD score.
Why are there two different CVSS scores?
NVD lists 9.8, while JetBrains lists 5.8 in the assembled data. The record does not explain the difference, so the reason is unknown.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.