CVE-2026-123851 · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
The JetBrains Junie GitHub Action before 1.6.4 has a prompt injection filter that can be bypassed using HTML-encoded characters. An attacker who can place text in a repository input the agent reads, such as an issue or pull request, may be able to steer the agent's actions.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run the Junie GitHub Action in CI on repository content that outside users can write, such as issues, pull requests or comments. Workflows that only run on trusted internal input, or that use a newer version, are not exposed.
Not affected if no-untrusted-input, version-1.6.4-or-later
Who cares ai-agents, ci, github-actions, junie
.github/workflows/), and confirm whether it is below 1.6.4.1.6.4 or later.In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.