AdvisoriesToolsStatsChecklistSubmitGet the email
← All advisories
CVE-2026-117530mediumCode execution2026-10-27

CVE-2026-117530: JetBrains Junie CLI before 26.8.17 could run commands because allowlisted commands weren't fully validated

JetBrains says command execution was possible in its Junie coding agent CLI before version 26.8.17 because validation of allowlisted commands was incomplete. In practice that means a command the agent was allowed to run without asking could be used to run something you never approved. JetBrains has published no further detail. Update Junie CLI to 26.8.17 or later.

01.

What it is

JetBrains' CVE description: "In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands."

JetBrains rates it CVSS 3.1 6.7 and lists it on its Fixed security issues page. No proof of concept or technical write-up is public.

02.

How to check

  1. Affected: JetBrains Junie CLI before 26.8.17.
  2. Your exposure is higher if you let Junie auto-run allowlisted commands while it works on repositories or content you don't fully trust.
03.

How to fix

  1. Update Junie CLI to 26.8.17 or later.
  2. Until you've updated, keep the auto-approve allowlist short and review commands before Junie runs them in untrusted repositories.
# check the installed Junie CLI version and update to 26.8.17 or later
04.

Sources

More advisories for this tool
The weekly email

One email a week. Only what changed.

Every new security hole in AI coding tools, MCP servers, app builders and the stacks they generate (Next.js, Supabase, Node, PHP), each with how to check your app and the fix. No roundups of things you already read.

Free, one email a week. Read the latest issue first if you like. One-click unsubscribe in every email. We never sell or share addresses.