Platform
jetbrains
Component
junie
Fixed in
252.549.29
CVE-2026-41153 describes a command execution vulnerability in JetBrains Junie versions prior to 252.549.29. An attacker can exploit this flaw by crafting a malicious project file that, when processed by Junie, executes arbitrary commands on the system. This vulnerability impacts users of JetBrains Junie and can lead to unauthorized access and control. The vulnerability has been fixed in version 252.549.29.
The primary impact of CVE-2026-41153 is the potential for remote code execution (RCE). An attacker could craft a specially designed project file that, when opened or processed by JetBrains Junie, would execute arbitrary commands on the host system. This could allow the attacker to gain control of the system, steal sensitive data, install malware, or perform other malicious actions. The blast radius extends to any system running a vulnerable version of JetBrains Junie and where a user can be tricked into opening a malicious project file. While the initial attack vector requires user interaction (opening the malicious file), the consequences can be severe.
CVE-2026-41153 was publicly disclosed on 2026-04-17. As of this writing, there are no publicly known proof-of-concept exploits. The vulnerability is not currently listed on the CISA KEV catalog. The EPSS score is likely to be low to medium, given the requirement for user interaction and the absence of public exploits, but this could change if an exploit is released.
Exploit Status
EPSS
0.00% (0% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-41153 is to immediately upgrade JetBrains Junie to version 252.549.29 or later. If an immediate upgrade is not possible due to compatibility issues or testing requirements, consider implementing stricter file access controls to prevent users from opening untrusted project files. Educate users about the risks of opening files from unknown or untrusted sources. There are no specific WAF or proxy rules that can directly mitigate this vulnerability, as it relies on processing malicious project files within the application itself. Monitor system logs for unusual command execution activity related to Junie.
Update to version 252.549.29 or higher to mitigate the command execution vulnerability via malicious project files. See the JetBrains security advisory for more details and instructions.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-41153 is a command execution vulnerability affecting JetBrains Junie versions 0–252.549.29, allowing attackers to execute arbitrary commands via malicious project files.
You are affected if you are using JetBrains Junie versions prior to 252.549.29. Check your version and upgrade immediately if vulnerable.
Upgrade JetBrains Junie to version 252.549.29 or later to remediate the vulnerability. Implement stricter file access controls as a temporary workaround.
As of now, there are no publicly known active exploits for CVE-2026-41153, but vigilance is advised.
Refer to the official JetBrains security advisory for CVE-2026-41153 on the JetBrains website.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.