CVE-2026-123315 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
JetBrains Junie CLI, an AI coding agent, could be made to execute commands through its Allow Similar Commands option before version 26.8.24. An attacker who can influence the agent's actions could get commands run on the machine where it runs.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run the JetBrains Junie CLI coding agent on developer machines or CI. The sources do not say which configurations or prompts trigger the flaw, so the exact exposure is unknown. Teams not using Junie CLI can skip it.
Not affected if junie-cli-not-installed
Who cares ai-coding-agent, jetbrains, junie-cli
26.8.2426.8.24 or laterIn JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.