JetBrains PyCharm CVE-2026-49384

Exploitation requires the victim to open a Jupyter notebook (.ipynb file) containing a malicious payload in a Markdown cell using PyCharm prior to version 2025.3.4. The attacker must be able to deliver the crafted notebook to the victim - through a shared repository, email attachment, dependency package, or collaborative project. The CVSS vector PR:N confirms the attacker needs no authentication or account on any shared system. UI:R confirms victim must actively open and render the notebook in PyCharm. Exploitation is limited to: (1) use of the Jupyter notebook feature within PyCharm specifically, (2) victim running an unpatched PyCharm version prior to 2025.3.4, and (3) successful delivery of the malicious .ipynb file. Passive repository browsing or editing raw JSON of the notebook file without rendering does not trigger the vulnerability.

The CVSS base score of 6.1 (Medium) reflects a network-reachable, low-complexity attack requiring no privileges but demanding user interaction (UI:R), with low confidentiality and integrity impact and a changed scope. Real-world risk is moderate-to-elevated in developer-heavy environments: PyCharm users routinely open Jupyter notebooks sourced from repositories, colleagues, or third-party packages, making the user-interaction barrier easy to overcome socially or via supply chain. No EPSS score was provided in the source data, limiting probabilistic exploitation forecasting. KEV status is absent, and no POC has been identified, suggesting no confirmed widespread exploitation at time of analysis. The primary limiting factor is that exploitation requires victim-side notebook rendering - passive repository browsing without opening notebooks is not sufficient. The changed scope (S:C) elevates residual risk beyond the raw 6.1 score in environments where PyCharm sessions have access to sensitive credentials or local services.

An attacker embeds a malicious JavaScript payload inside a Markdown cell of a Jupyter notebook (e.g., via a public GitHub repository, a shared data science project, or a dependency's example notebook). When a developer opens the notebook in PyCharm prior to 2025.3.4, the unsanitized Markdown is rendered and the script executes within PyCharm's notebook viewer context. Depending on the sandbox, the script could exfiltrate environment variables, local tokens, or session data accessible to the IDE process. No public POC has been identified at time of analysis.