Pycharm
CVE-2026-25847
HIGH
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible
AnalysisAI
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible [CVSS 8.2 HIGH]
Technical ContextAI
Classified as CWE-79 (Cross-site Scripting (XSS)). Affects Pycharm. In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible
RemediationAI
Monitor vendor advisories for a patch. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.
In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. Rated high se
In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the
In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible. Rated hig
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. Rated high
Stored XSS in JetBrains PyCharm's Jupyter notebook Markdown cell renderer allows a remote, unauthenticated attacker to e
In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible. Rated low severit
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today