Pycharm
CVE-2020-11694
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 2019.3.3.
AnalysisAI
In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-312. In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. This is fixed in 2019.2.6 and 2019.3.3. Affected products include: Jetbrains Pycharm.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Arbitrary code execution in JetBrains PyCharm before 2026.1.4 and 2026.2 lets an attacker who supplies a crafted project
Code execution in JetBrains PyCharm before 2026.2.1 is possible through Jupyter MCP (Model Context Protocol) tools that
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible [CVSS 8.2 HIGH]
In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the
In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible. Rated hig
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. Rated high
Stored XSS in JetBrains PyCharm's Jupyter notebook Markdown cell renderer allows a remote, unauthenticated attacker to e
Cross-site scripting in JetBrains PyCharm's Quick Documentation rendering feature (before version 2026.2.1) enables code
In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible. Rated low severit
Same weakness CWE-312 – Cleartext Storage of Sensitive Information
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today