Live › vulnerability › CVE-2026-117530
Go to dashboardJunie CLI, JetBrains' AI coding agent, validated allowlisted commands incompletely before version 26.8.17. Per the advisory text, an attacker can get command execution through that gap.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Teams running JetBrains Junie CLI before 26.8.17, especially where the agent is allowed to run shell commands from an allowlist. The sources do not describe the exact trigger, so whether an untrusted input can reach the allowlist check is unknown. Teams not using Junie CLI can skip this.
No product ranges from the sources yet.
junie --version (or the equivalent version command for the installed Junie CLI) and compare against 26.8.1726.8.17 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands
This page as .md · .json · in your agent: get_signal("CVE-2026-117530")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.