CVE-2026-123852highCode execution2026-11-06
CVE-2026-123852: In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates
In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates
What it is
In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates
How to check
- Compare your installed version with the range above (command below).
How to fix
Sources
More advisories for this tool
- highCVE-2026-123315: In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option
- highCVE-2026-111091: JetBrains Junie CLI ran code from an untrusted project’s MCP config
- mediumCVE-2026-123851: In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters
- mediumCVE-2026-123316: In JetBrains Junie CLI before 26.6.29 sensitive environment variables were exposed in session event logs