JetBrains Junie CLI CVE-2026-111091

Exploitation requires the victim to open and use an untrusted/attacker-supplied project in JetBrains Junie CLI (versions before 26.8.3) where that project contains a malicious MCP (Model Context Protocol) server configuration; the untrusted project's MCP configuration is the specific trigger named in the description. Limiting factors that reduce real-world risk: local access is implied (AV:L) - the attacker must deliver the malicious project rather than reach the target over the network; user interaction is mandatory (UI:R) - the developer must actually open/run the untrusted project; and only Junie CLI builds prior to 26.8.3 are affected, so upgrading remediates. There is no privilege prerequisite (PR:N): any user who opens such a project is exposed.

This is a code-execution flaw (CWE-829, inclusion of untrusted functionality) in JetBrains Junie CLI, rated CVSS 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The signals are internally consistent and point to a developer-targeted supply-chain-style risk rather than a mass-exploitable remote flaw: the Local attack vector (AV:L) plus required user interaction (UI:R) means an attacker cannot reach the victim over the network - they must get the victim to open and work with a malicious project. No EPSS probability, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The high confidentiality/integrity/availability impacts (C:H/I:H/A:H) reflect that successful exploitation yields arbitrary code execution in the user's context. Net: a genuinely serious bug for anyone who opens untrusted repositories with Junie, but the local vector and user-interaction requirement keep real-world urgency below that of a network-exploitable unauthenticated RCE. PR:N is reported despite the operator-dependent nature of the flaw because no prior authentication is needed - the trust decision is the user opening the project, captured by UI:R rather than PR.

An attacker publishes or shares a repository (e.g., via GitHub, npm, or a tutorial) that contains a malicious MCP server configuration. A developer clones and opens this untrusted project in Junie CLI (before 26.8.3), and the embedded MCP server configuration causes attacker-controlled code to execute on the developer's machine. No public exploit code was identified in the provided data, but the technique mirrors well-known 'malicious repo on open' attacks against AI/IDE tooling.