CVE-2026-123852 · Package
NO FIX YET · SEE WHAT TO DO
Before version 1.8.0, the JetBrains Junie GitHub Action allowed code execution with the workflow's credentials when a fork was updated. An attacker who can push changes through a fork can run code with the secrets available to the workflow.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Repositories that run the JetBrains Junie GitHub Action at a version before 1.8.0, particularly workflows triggered by changes arriving from forks that have access to workflow credentials. Repositories that do not use the action, or that pin 1.8.0 or later, are not affected per the sources.
Not affected if action-not-used, version-1.8.0-or-later
Who cares ci, github-actions, jetbrains, junie
.github/workflows1.8.0 is affected per the sources1.8.0 or laterIn JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.