CVE-2026-123855 · Other
NO FIX YET · SEE WHAT TO DO
JetBrains Toolbox App, a desktop launcher for JetBrains IDEs, runs commands built from enterprise configuration URLs without proper sanitization before version 3.6.1. An attacker who can supply or influence such a URL can get injected commands executed on the developer's machine.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that use JetBrains Toolbox App with enterprise configuration URLs are exposed on machines running a version before 3.6.1. Developers on standalone installs without enterprise configuration URLs are less exposed. The sources do not describe the exact URL conditions or whether user interaction is needed.
Not affected if no-enterprise-config-urls, standalone-install
Who cares developer-workstations, enterprise, jetbrains, toolbox-app
3.6.1.3.6.1 or later.In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.