JetBrains vulnerabilities
We track 26 vulnerabilities in JetBrains products across 21 products. 26 are rated high or critical, and 4 have been exploited in real attacks. The most recent was published on November 6, 2026.
Latest JetBrains vulnerabilities
- 8.4 High severity
YouTrack: Missing Authorization
In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation
- 7.8 High severity
IntelliJ IDEA: Inclusion of Functionality from Untrusted Control Sphere
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery
- 9.0 Critical severity
Toolbox App: Improper Certificate Validation
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover before 2026.3 and 2026.2.5,
- 8.0 High severity
IntelliJ IDEA: Improper Check for Certificate Revocation
In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3
- 7.1 High severity
YouTrack: Incorrect Authorization
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
- 7.1 High severity
YouTrack: Incorrect Authorization
In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates
- 8.8 High severity
TeamCity: Improper Neutralization of Special Elements used in an OS Command
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
- 8.4 High severity
IntelliJ IDEA: Missing Authentication for Critical Functionality
In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts
- 7.7 High severity
YouTrack: Incorrect Authorization
In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission
- 9.8 Critical severity
YouTrack: Authentication Bypass by Spoofing
In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeover via a self-asserted email address
- 9.1 Critical severity
YouTrack: Authentication Bypass Using an Alternate Path or Channel
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature
- 8.1 High severity
YouTrack: Missing Authorization
In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint
- 9.8 Critical severity
JetBrains TeamCity Deserialization of Untrusted Data Exploited
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
- 9.8 Critical severity
YouTrack: Missing Authentication for Critical Functionality
In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
- 8.8 High severity
Hub: Improperly Controlled Modification of Dynamically-Determined Object Attributes
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible
- 9.8 Critical severity
Hub: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible
- 9.8 Critical severity
Hub: Missing Authentication for Critical Functionality
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible
- 7.5 High severity
IntelliJ IDEA: Improper Link Resolution Before File Access
In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server
- 9.8 Critical severity
Junie: Improper Neutralization of Special Elements used in a Command
In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 code execution was possible due to improper command validation
- 7.5 High severity
Junie: Missing User Interaction for Potentially Unsafe Action
In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 information disclosure was possible via search_project function
- 7.8 High severity
ReSharper: Process Control
In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible
- 7.5 High severity
IntelliJ IDEA: Insufficiently Protected Credentials
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGri
- 7.3 High severity
JetBrains TeamCity Relative Path Traversal Exploited
In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible
- 9.8 Critical severity
JetBrains TeamCity Authentication Bypass Exploited
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
- 9.8 Critical severity
IntelliJ IDEA: Insufficient Verification of Data Authenticity
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration
- 9.8 Critical severity
JetBrains TeamCity Authentication Bypass Exploited
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible