{"id":"CVE-2026-123831","kind":"vulnerability","aliases":["CVE-2026-123831"],"related":[],"title":"CLion: Meson project settings run code even in Safe Mode","description":"In JetBrains CLion before 2026.2, \n2026.1.4 code execution was possible in Safe Mode via Meson project settings","summary":"JetBrains CLion, a C and C++ IDE, could run attacker-supplied code through Meson project settings even when Safe Mode was on. An attacker who gets a developer to open a crafted project can run code on that developer's machine.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c++","clion","developer-tools","jetbrains","meson","other"],"not_affected_if":["trusted-projects-only","updated-ide"],"how_to_check":"- Check the installed CLion version under Help > About in the IDE.\n- Look for a Meson build configuration in projects you open from untrusted sources.","fix":"- CLion before `2026.2` and `2026.1.4` is affected; move to `2026.2` or `2026.1.4` or later.","status":"open","published_at":"2026-11-06T17:17:21+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","triaged_at":"2026-11-06T17:44:50+00:00","updated_at":"2026-11-06T17:44:50+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T17:44:50Z","model":"claude-haiku-5-5","output":{"fix":"- CLion before `2026.2` and `2026.1.4` is affected; move to `2026.2` or `2026.1.4` or later.","reach":"local","title":"CLion: Meson project settings run code even in Safe Mode","impact":"high","summary":"JetBrains CLion, a C and C++ IDE, could run attacker-supplied code through Meson project settings even when Safe Mode was on. An attacker who gets a developer to open a crafted project can run code on that developer's machine.","audience":"developers","category":"other","nicknames":[],"who_cares":["clion","jetbrains","meson","c++","developer-tools"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"code runs on the developer's workstation with their privileges","analyst_note":"Confirm the exact trigger and whether opening a project is the only interaction needed, using the JetBrains advisory and the NVD entry.","how_to_check":"- Check the installed CLion version under Help > About in the IDE.\n- Look for a Meson build configuration in projects you open from untrusted sources.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-projects-only","updated-ide"],"who_is_affected":"Developers who open CLion projects that use Meson build settings, especially projects from untrusted sources, because Safe Mode did not block the code path. Teams that only open their own trusted projects are less exposed but should still update. The sources do not say whether the flaw is reachable without opening a project.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000694,"input_tokens":4177,"output_tokens":552,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-123831':13A,16A '-2026':12A,15A '2026.1.4':71C '2026.2':70C 'attack':34B,48B 'attacker-suppli':33B 'c':17B,27B,29B 'clion':1A,18B,25B,68C 'code':6A,36B,60B,72C 'could':31B 'craft':56B 'cve':11A,14A 'develop':20B,52B,63B 'developer-tool':19B 'even':7A,41B 'execut':73C 'get':50B 'ide':30B 'jetbrain':22B,24B,67C 'machin':65B 'meson':2A,23B,38B,80C 'mode':10A,44B,78C 'open':54B 'possibl':75C 'project':3A,39B,57B,81C 'run':5A,32B,59B 'safe':9A,43B,77C 'set':4A,40B,82C 'suppli':35B 'tool':21B 'via':79C","nicknames":[],"mitigations":[],"who_affected":"Developers who open CLion projects that use Meson build settings, especially projects from untrusted sources, because Safe Mode did not block the code path. Teams that only open their own trusted projects are less exposed but should still update. The sources do not say whether the flaw is reachable without opening a project.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["c","clion","critical","developertools","jetbrains","meson","other"],"campaign_type":null,"search_a":"'-123831':13A,16A '-2026':12A,15A 'clion':1A 'code':6A 'cve':11A,14A 'even':7A 'meson':2A 'mode':10A 'project':3A 'run':5A 'safe':9A 'set':4A","search_b":"'attack':34B,48B 'attacker-suppli':33B 'c':17B,27B,29B 'clion':18B,25B 'code':36B,60B 'could':31B 'craft':56B 'develop':20B,52B,63B 'developer-tool':19B 'even':41B 'get':50B 'ide':30B 'jetbrain':22B,24B 'machin':65B 'meson':23B,38B 'mode':44B 'open':54B 'project':39B,57B 'run':32B,59B 'safe':43B 'set':40B 'suppli':35B 'tool':21B","search_c":"'2026.1.4':71C '2026.2':70C 'clion':68C 'code':72C 'execut':73C 'jetbrain':67C 'meson':80C 'mode':78C 'possibl':75C 'project':81C 'safe':77C 'set':82C 'via':79C","first_public_at":"2026-11-06T17:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123831","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123831","severity":null,"published_at":"2026-11-06T17:17:21+00:00","modified_at":"2026-11-06T17:17:21+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","fetched_at":"2026-11-06T17:43:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}