{"id":"CVE-2026-123279","kind":"vulnerability","aliases":["CVE-2026-123279"],"related":[],"title":"JetBrains Datalore: view-only collaborators can execute code in notebooks","description":"In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators","summary":"In JetBrains Datalore before 2026.4, a user with view-only access to a notebook could execute code during the notebook's computation. The sources do not say what the code can reach beyond that.","severity":"critical","cvss":9.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["datalore","jetbrains","notebooks","other"],"not_affected_if":["version-2026.4-or-later"],"how_to_check":"- Check the installed Datalore version against `2026.4`; the sources state that versions before it are affected.\n- Review which collaborators have view-only access to shared notebooks.","fix":"- Datalore: move to `2026.4` or later, per the product range in the source.","status":"open","published_at":"2026-11-06T11:17:06+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","triaged_at":"2026-11-06T11:41:47+00:00","updated_at":"2026-11-06T11:41:47+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T11:41:47Z","model":"claude-haiku-5-5","output":{"fix":"- Datalore: move to `2026.4` or later, per the product range in the source.","reach":"network","title":"JetBrains Datalore: view-only collaborators can execute code in notebooks","impact":"high","summary":"In JetBrains Datalore before 2026.4, a user with view-only access to a notebook could execute code during the notebook's computation. The sources do not say what the code can reach beyond that.","audience":"businesses","category":"other","nicknames":[],"who_cares":["jetbrains","datalore","notebooks"],"confidence":0.5,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs in the notebook computation via a view-only account","analyst_note":"Check the JetBrains Datalore advisory for the CVE-2026-123279 product range, deployment conditions and any workaround; the NVD entry alone gives only the one-line description.","how_to_check":"- Check the installed Datalore version against `2026.4`; the sources state that versions before it are affected.\n- Review which collaborators have view-only access to shared notebooks.","plain_action":"","needs_analyst":true,"not_affected_if":["version-2026.4-or-later"],"who_is_affected":"Teams running JetBrains Datalore before 2026.4 that share notebooks with collaborators who have view-only access. The sources do not describe the deployment mode or any further conditions, so exposure beyond this is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000676,"input_tokens":4166,"output_tokens":518,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-123279':14A,17A '-2026':13A,16A '2026.4':25B,59C 'access':32B 'beyond':54B 'code':9A,38B,51B,60C 'collabor':6A,73C 'comput':43B,68C 'could':36B 'cve':12A,15A 'datalor':2A,18B,23B,57C 'execut':8A,37B,61C 'jetbrain':1A,19B,22B,56C 'notebook':11A,20B,35B,41B,66C 'possibl':63C 'reach':53B 'say':48B 'sourc':45B 'user':27B 'view':4A,30B,71C 'view-on':3A,29B,70C","nicknames":[],"mitigations":[],"who_affected":"Teams running JetBrains Datalore before 2026.4 that share notebooks with collaborators who have view-only access. The sources do not describe the deployment mode or any further conditions, so exposure beyond this is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","datalore","jetbrains","notebooks","other"],"campaign_type":null,"search_a":"'-123279':14A,17A '-2026':13A,16A 'code':9A 'collabor':6A 'cve':12A,15A 'datalor':2A 'execut':8A 'jetbrain':1A 'notebook':11A 'view':4A 'view-on':3A","search_b":"'2026.4':25B 'access':32B 'beyond':54B 'code':38B,51B 'comput':43B 'could':36B 'datalor':18B,23B 'execut':37B 'jetbrain':19B,22B 'notebook':20B,35B,41B 'reach':53B 'say':48B 'sourc':45B 'user':27B 'view':30B 'view-on':29B","search_c":"'2026.4':59C 'code':60C 'collabor':73C 'comput':68C 'datalor':57C 'execut':61C 'jetbrain':56C 'notebook':66C 'possibl':63C 'view':71C 'view-on':70C","first_public_at":"2026-11-06T11:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123279","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123279","severity":null,"published_at":"2026-11-06T11:17:06+00:00","modified_at":"2026-11-06T11:17:06+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","fetched_at":"2026-11-06T11:41:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}