JetBrains Rider CVE-2026-100265

Exploitation requires the victim to be running Rider before 2026.2.1 with the AI Assistant feature active and at least one third-party 'skill' installed from a source the attacker can influence or compromise. The defining condition is that the AI Assistant auto-updates these third-party skills without user confirmation or an integrity check, so the attacker must be positioned to serve a malicious skill update through a source the victim already trusts. Limiting factors: high attack complexity (attacker must control a trusted third-party skill source), impact is confined to the developer's IDE environment with only low confidentiality/integrity effect and no availability impact, and a fixed version (2026.2.1) is available.

This is a genuinely low-priority issue despite the moderate 4.8 CVSS score. The vendor vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) reflects an unauthenticated, network-reachable weakness but with high attack complexity (AC:H) and only low confidentiality and integrity impact - no availability impact. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept provided, so real-world exploitation pressure is minimal: no public exploit identified at time of analysis. No SSVC decision data was supplied. The core weakness (CWE-494, Download of Code Without Integrity Check) is a supply-chain/trust issue in the AI Assistant's handling of third-party 'skills' rather than a directly weaponizable remote flaw; an attacker cannot trigger it broadly without first controlling a third-party skill source that a victim has installed, which is what justifies AC:H. Note a labeling conflict: the CVE is tagged 'Information Disclosure' but the CWE (494) and description point to an integrity/untrusted-code-update problem, not primarily disclosure - treat the disclosure framing with skepticism. Overall this is a high-CVSS-relative-to-real-risk item best handled through routine patching, not emergency response.

An attacker who controls or compromises a third-party AI Assistant 'skill' distribution source pushes a malicious update; a developer running a vulnerable Rider build has that skill auto-updated without any confirmation prompt, silently pulling attacker-controlled code/logic into their IDE. Because the update proceeds without an integrity check or user consent, the developer never gets a chance to reject it. No public proof-of-concept exists at the time of analysis, and the high attack complexity (AC:H) reflects the prerequisite of controlling a trusted skill source.