Junie CVE-2026-41153

User must actively open or load a malicious project file in JetBrains Junie. The vulnerability requires manual user interaction (UI:R in CVSS vector) - Junie does not automatically execute the vulnerability upon installation or network exposure. The malicious payload must be embedded in a project configuration file format that Junie processes. Default Junie installations are vulnerable; no special configuration is required for the product to be susceptible, but the attacker's malicious file must reach the victim's system and the victim must choose to open it. Exploitation is limited to local execution - remote code execution is not possible through network protocols without prior file delivery.

CVSS 5.8 with local attack vector (AV:L) and high complexity (AC:H) indicates moderate risk with meaningful constraints. The local access requirement and user interaction (UI:R - user must open the malicious project file) significantly limit real-world exploitability compared to a remote network attack. However, the high confidentiality impact (C:H) and integrity/availability impact (I:L, A:L) represent meaningful compromise if exploitation occurs. EPSS score, POC availability, and KEV status are not provided in the input data, preventing assessment of actual exploitation prevalence. The vulnerability is NOT remotely exploitable - an attacker must trick a user into opening a malicious project file on the same system, making social engineering a prerequisite. For organizations with strong endpoint controls and user training, practical risk is lower than CVSS alone suggests. For environments with shared workstations or less-controlled user behavior, risk is higher.

An attacker crafts a malicious Junie project file (.junie or project configuration) embedding shell commands in a field that Junie processes during file parsing. The attacker shares this file via email, file-sharing service, or social engineering. When a target user opens the malicious project in Junie, the application parses the file and passes the unsanitized command injection payload to a shell execution function. The embedded commands execute with the privileges of the user running Junie, potentially exfiltrating data or installing malware.