---
id: "CVE-2026-117530"
kind: "vulnerability"
aliases: ["CVE-2026-117530"]
title: "JetBrains Junie CLI: incomplete allowlist check lets commands execute"
severity: "medium"
cvss: 6.7
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "coding-agent", "developer-workstation", "jetbrains", "junie-cli"]
not_affected_if: ["junie-cli-not-installed", "version-26.8.17-or-later"]
published_at: "2026-10-27T11:17:33+00:00"
first_seen_at: "2026-10-27T11:31:28+00:00"
updated_at: "2026-10-27T11:31:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117530", "first_seen_at": "2026-10-27T11:31:28+00:00"}]
---

# JetBrains Junie CLI: incomplete allowlist check lets commands execute

Junie CLI, JetBrains' AI coding agent, validated allowlisted commands incompletely before version 26.8.17. Per the advisory text, an attacker can get command execution through that gap.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `junie --version` (or the equivalent version command for the installed Junie CLI) and compare against `26.8.17`
- Check the installed Junie CLI package version in the environment where it runs
- unknown whether the sources give further detail on configuration that enables the allowlist

## Fix

- Upgrade JetBrains Junie CLI to `26.8.17` or later
- unknown whether a workaround exists before upgrading

## Timeline

- 2026-10-27T11:31:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117530

## From the sources

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_