{"id":"CVE-2026-123851","kind":"vulnerability","aliases":["CVE-2026-123851"],"related":[],"title":"JetBrains Junie GitHub Action: prompt injection protection bypassed via HTML encoding","description":"In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters","summary":"The JetBrains Junie GitHub Action before 1.6.4 has a prompt injection filter that can be bypassed using HTML-encoded characters. An attacker who can place text in a repository input the agent reads, such as an issue or pull request, may be able to steer the agent's actions.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","ci","github-actions","junie"],"not_affected_if":["no-untrusted-input","version-1.6.4-or-later"],"how_to_check":"- Check the version of the Junie GitHub Action referenced in your workflow files (`.github/workflows/`), and confirm whether it is below `1.6.4`.\n- Look for workflows that run Junie on issues, pull requests or comments from outside contributors.","fix":"- JetBrains Junie GitHub Action: move to `1.6.4` or later.","status":"open","published_at":"2026-11-06T17:17:24+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:45:23+00:00","updated_at":"2026-11-06T17:45:23+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-11-06T17:45:23Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains Junie GitHub Action: move to `1.6.4` or later.","reach":"internet","title":"JetBrains Junie GitHub Action: prompt injection protection bypassed via HTML encoding","impact":"medium","summary":"The JetBrains Junie GitHub Action before 1.6.4 has a prompt injection filter that can be bypassed using HTML-encoded characters. An attacker who can place text in a repository input the agent reads, such as an issue or pull request, may be able to steer the agent's actions.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["github-actions","junie","ci","ai-agents"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"agent performs unintended actions in the repository under its token","analyst_note":"Sources do not say what actions the agent can take or what token scope it uses; check the NVD entry and JetBrains advisory for details.","how_to_check":"- Check the version of the Junie GitHub Action referenced in your workflow files (`.github/workflows/`), and confirm whether it is below `1.6.4`.\n- Look for workflows that run Junie on issues, pull requests or comments from outside contributors.","plain_action":"","needs_analyst":true,"not_affected_if":["version-1.6.4-or-later","no-untrusted-input"],"who_is_affected":"Teams that run the Junie GitHub Action in CI on repository content that outside users can write, such as issues, pull requests or comments. Workflows that only run on trusted internal input, or that use a newer version, are not exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000715,"input_tokens":4180,"output_tokens":594,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123851':14A,17A '-2026':13A,16A '1.6.4':35B,85C 'abl':72B 'action':4A,27B,33B,78B,83C 'agent':20B,61B,76B 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'attack':51B 'bypass':8A,44B,91C 'charact':49B,96C 'ci':24B 'could':89C 'cve':12A,15A 'encod':11A,48B,95C 'filter':40B 'github':3A,26B,32B,82C 'github-act':25B 'html':10A,47B,94C 'html-encod':46B,93C 'inject':6A,39B,87C 'input':59B 'issu':66B 'jetbrain':1A,30B,80C 'juni':2A,28B,31B,81C 'may':70B 'place':54B 'prompt':5A,38B,86C 'protect':7A,88C 'pull':68B 'read':62B 'repositori':58B 'request':69B 'steer':74B 'text':55B 'tool':23B 'use':45B 'via':9A,92C","nicknames":[],"mitigations":[],"who_affected":"Teams that run the Junie GitHub Action in CI on repository content that outside users can write, such as issues, pull requests or comments. Workflows that only run on trusted internal input, or that use a newer version, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aiagents","aitooling","ci","githubactions","junie","medium"],"campaign_type":null,"search_a":"'-123851':14A,17A '-2026':13A,16A 'action':4A 'bypass':8A 'cve':12A,15A 'encod':11A 'github':3A 'html':10A 'inject':6A 'jetbrain':1A 'juni':2A 'prompt':5A 'protect':7A 'via':9A","search_b":"'1.6.4':35B 'abl':72B 'action':27B,33B,78B 'agent':20B,61B,76B 'ai':19B,22B 'ai-ag':18B 'ai-tool':21B 'attack':51B 'bypass':44B 'charact':49B 'ci':24B 'encod':48B 'filter':40B 'github':26B,32B 'github-act':25B 'html':47B 'html-encod':46B 'inject':39B 'input':59B 'issu':66B 'jetbrain':30B 'juni':28B,31B 'may':70B 'place':54B 'prompt':38B 'pull':68B 'read':62B 'repositori':58B 'request':69B 'steer':74B 'text':55B 'tool':23B 'use':45B","search_c":"'1.6.4':85C 'action':83C 'bypass':91C 'charact':96C 'could':89C 'encod':95C 'github':82C 'html':94C 'html-encod':93C 'inject':87C 'jetbrain':80C 'juni':81C 'prompt':86C 'protect':88C 'via':92C","first_public_at":"2026-11-06T17:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123851","severity":null,"published_at":"2026-11-06T17:17:24+00:00","modified_at":"2026-11-06T17:17:24+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}