{"id":"CVE-2026-123315","kind":"vulnerability","aliases":["CVE-2026-123315"],"related":[],"title":"JetBrains Junie CLI: Allow Similar Commands option enables command execution","description":"In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option","summary":"JetBrains Junie CLI, an AI coding agent, could be made to execute commands through its Allow Similar Commands option before version 26.8.24. An attacker who can influence the agent's actions could get commands run on the machine where it runs.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-coding-agent","ai-tooling","jetbrains","junie-cli"],"not_affected_if":["junie-cli-not-installed"],"how_to_check":"- Check the installed Junie CLI version and compare it with `26.8.24`","fix":"- JetBrains Junie CLI: `26.8.24` or later","status":"open","published_at":"2026-11-06T11:17:10+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","triaged_at":"2026-11-06T11:42:11+00:00","updated_at":"2026-11-06T11:42:11+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-06T11:42:11Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains Junie CLI: `26.8.24` or later","reach":"unknown","title":"JetBrains Junie CLI: Allow Similar Commands option enables command execution","impact":"high","summary":"JetBrains Junie CLI, an AI coding agent, could be made to execute commands through its Allow Similar Commands option before version 26.8.24. An attacker who can influence the agent's actions could get commands run on the machine where it runs.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["junie-cli","jetbrains","ai-coding-agent"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Commands run on the machine running the agent.","analyst_note":"Check the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-123315) and JetBrains release notes for the trigger conditions and whether the Allow Similar Commands option must be enabled.","how_to_check":"- Check the installed Junie CLI version and compare it with `26.8.24`\n- unknown for other checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["junie-cli-not-installed"],"who_is_affected":"Teams that run the JetBrains Junie CLI coding agent on developer machines or CI. The sources do not say which configurations or prompts trigger the flaw, so the exact exposure is unknown. Teams not using Junie CLI can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000695,"input_tokens":4163,"output_tokens":558,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123315':13A,16A '-2026':12A,15A '26.8.24':49B,74C 'action':58B 'agent':20B,34B,56B 'ai':18B,22B,32B 'ai-coding-ag':17B 'ai-tool':21B 'allow':4A,43B,81C 'attack':51B 'cli':3A,27B,30B,72C 'code':19B,33B 'command':6A,9A,40B,45B,61B,75C,83C 'could':35B,59B 'cve':11A,14A 'enabl':8A 'execut':10A,39B,76C 'get':60B 'influenc':54B 'jetbrain':1A,24B,28B,70C 'juni':2A,26B,29B,71C 'junie-c':25B 'machin':65B 'made':37B 'option':7A,46B,84C 'possibl':78C 'run':62B,68B 'similar':5A,44B,82C 'tool':23B 'version':48B 'via':79C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the JetBrains Junie CLI coding agent on developer machines or CI. The sources do not say which configurations or prompts trigger the flaw, so the exact exposure is unknown. Teams not using Junie CLI can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aicodingagent","aitooling","high","jetbrains","juniecli"],"campaign_type":null,"search_a":"'-123315':13A,16A '-2026':12A,15A 'allow':4A 'cli':3A 'command':6A,9A 'cve':11A,14A 'enabl':8A 'execut':10A 'jetbrain':1A 'juni':2A 'option':7A 'similar':5A","search_b":"'26.8.24':49B 'action':58B 'agent':20B,34B,56B 'ai':18B,22B,32B 'ai-coding-ag':17B 'ai-tool':21B 'allow':43B 'attack':51B 'cli':27B,30B 'code':19B,33B 'command':40B,45B,61B 'could':35B,59B 'execut':39B 'get':60B 'influenc':54B 'jetbrain':24B,28B 'juni':26B,29B 'junie-c':25B 'machin':65B 'made':37B 'option':46B 'run':62B,68B 'similar':44B 'tool':23B 'version':48B","search_c":"'26.8.24':74C 'allow':81C 'cli':72C 'command':75C,83C 'execut':76C 'jetbrain':70C 'juni':71C 'option':84C 'possibl':78C 'similar':82C 'via':79C","first_public_at":"2026-11-06T11:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123315","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123315","severity":null,"published_at":"2026-11-06T11:17:10+00:00","modified_at":"2026-11-06T11:17:10+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","fetched_at":"2026-11-06T11:41:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}