{"id":"CVE-2026-123855","kind":"vulnerability","aliases":["CVE-2026-123855"],"related":[],"title":"JetBrains Toolbox App: enterprise config URLs allow command injection before 3.6.1","description":"In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs","summary":"JetBrains Toolbox App, a desktop launcher for JetBrains IDEs, runs commands built from enterprise configuration URLs without proper sanitization before version 3.6.1. An attacker who can supply or influence such a URL can get injected commands executed on the developer's machine.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-workstations","enterprise","jetbrains","other","toolbox-app"],"not_affected_if":["no-enterprise-config-urls","standalone-install"],"how_to_check":"- Check the installed Toolbox App version (Help or About in the app) and see whether it is below `3.6.1`.\n- Check whether your organization pushes enterprise configuration URLs to Toolbox App.","fix":"- JetBrains Toolbox App: move to `3.6.1` or later.","status":"open","published_at":"2026-11-06T17:17:24+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:45:03+00:00","updated_at":"2026-11-06T17:45:03+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T17:45:03Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains Toolbox App: move to `3.6.1` or later.","reach":"unknown","title":"JetBrains Toolbox App: enterprise config URLs allow command injection before 3.6.1","impact":"high","summary":"JetBrains Toolbox App, a desktop launcher for JetBrains IDEs, runs commands built from enterprise configuration URLs without proper sanitization before version 3.6.1. An attacker who can supply or influence such a URL can get injected commands executed on the developer's machine.","audience":"developers","category":"other","nicknames":[],"who_cares":["jetbrains","toolbox-app","enterprise","developer-workstations"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Injected commands run on the developer's workstation with the user's privileges.","analyst_note":"Confirm the attack prerequisites (who controls the enterprise configuration URL, any user interaction) from the JetBrains advisory, which the sources do not link.","how_to_check":"- Check the installed Toolbox App version (Help or About in the app) and see whether it is below `3.6.1`.\n- Check whether your organization pushes enterprise configuration URLs to Toolbox App.","plain_action":"","needs_analyst":true,"not_affected_if":["standalone-install","no-enterprise-config-urls"],"who_is_affected":"Teams that use JetBrains Toolbox App with enterprise configuration URLs are exposed on machines running a version before 3.6.1. Developers on standalone installs without enterprise configuration URLs are less exposed. The sources do not describe the exact URL conditions or whether user interaction is needed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000724,"input_tokens":4161,"output_tokens":616,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123855':14A,17A '-2026':13A,16A '3.6.1':11A,48B,74C 'allow':7A 'app':3A,26B,29B,72C 'attack':50B 'built':38B 'command':8A,37B,62B,75C 'config':5A 'configur':41B,81C 'cve':12A,15A 'desktop':31B 'develop':19B,66B 'developer-workst':18B 'enterpris':4A,21B,40B,80C 'execut':63B 'get':60B 'ide':35B 'influenc':55B 'inject':9A,61B,76C 'jetbrain':1A,22B,27B,34B,70C 'launcher':32B 'machin':68B 'possibl':78C 'proper':44B 'run':36B 'sanit':45B 'suppli':53B 'toolbox':2A,25B,28B,71C 'toolbox-app':24B 'url':6A,42B,58B,82C 'version':47B 'via':79C 'without':43B 'workstat':20B","nicknames":[],"mitigations":[],"who_affected":"Teams that use JetBrains Toolbox App with enterprise configuration URLs are exposed on machines running a version before 3.6.1. Developers on standalone installs without enterprise configuration URLs are less exposed. The sources do not describe the exact URL conditions or whether user interaction is needed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developerworkstations","enterprise","high","jetbrains","other","toolboxapp"],"campaign_type":null,"search_a":"'-123855':14A,17A '-2026':13A,16A '3.6.1':11A 'allow':7A 'app':3A 'command':8A 'config':5A 'cve':12A,15A 'enterpris':4A 'inject':9A 'jetbrain':1A 'toolbox':2A 'url':6A","search_b":"'3.6.1':48B 'app':26B,29B 'attack':50B 'built':38B 'command':37B,62B 'configur':41B 'desktop':31B 'develop':19B,66B 'developer-workst':18B 'enterpris':21B,40B 'execut':63B 'get':60B 'ide':35B 'influenc':55B 'inject':61B 'jetbrain':22B,27B,34B 'launcher':32B 'machin':68B 'proper':44B 'run':36B 'sanit':45B 'suppli':53B 'toolbox':25B,28B 'toolbox-app':24B 'url':42B,58B 'version':47B 'without':43B 'workstat':20B","search_c":"'3.6.1':74C 'app':72C 'command':75C 'configur':81C 'enterpris':80C 'inject':76C 'jetbrain':70C 'possibl':78C 'toolbox':71C 'url':82C 'via':79C","first_public_at":"2026-11-06T17:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123855","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123855","severity":null,"published_at":"2026-11-06T17:17:24+00:00","modified_at":"2026-11-06T17:17:24+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}