---
id: "CVE-2026-123285"
page: "https://infrastack.ai/live/CVE-2026-123285"
kind: "vulnerability"
aliases: ["CVE-2026-123285"]
title: "JetBrains Datalore: JVM option injection allows command execution in database containers"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["datalore", "jetbrains", "other", "self-hosted"]
not_affected_if: ["version-2026.3-or-later"]
published_at: "2026-11-06T11:17:06+00:00"
first_seen_at: "2026-11-06T11:41:24+00:00"
updated_at: "2026-11-06T11:42:22+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123285", "first_seen_at": "2026-11-06T11:41:24+00:00"}]
exploit_sources: []
---

# JetBrains Datalore: JVM option injection allows command execution in database containers

Link for people: https://infrastack.ai/live/CVE-2026-123285 (this .md is for agents)

Before version 2026.3, JetBrains Datalore let an attacker inject JVM options into the database task container, which allowed command execution there. The sources do not say what access the attacker needs to reach that path.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Datalore version in the admin console or install directory against `2026.3`

## Fix

- JetBrains Datalore: move to `2026.3` or later

## Timeline

- 2026-11-06T11:41:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123285

## From the sources

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_