JetBrains Junie CLI EUVD-2026-110698

Exploitation requires the attacker to get a command past Junie CLI's allowlist validation (CWE-184, incomplete list of disallowed inputs), so the specific prerequisite is the presence and use of the command-allowlisting feature that fails to fully validate entries in versions before 26.8.17. Limiting factors per the CVSS vector: it is a local vector (AV:L) requiring at least low-level privileges (PR:L) on the host, mandatory user interaction (UI:R) - i.e. the victim must actually run the agent - and high attack complexity (AC:H), meaning conditions outside the attacker's direct control must align. The precise mechanism by which the allowlist is bypassed is not described in the available sources. Only Junie CLI versions below 26.8.17 are affected.

This is a moderate-severity, context-dependent issue rather than an emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H, score 6.7) describes a locally-exploitable flaw that requires some existing privileges (PR:L), user interaction (UI:R), and has high attack complexity (AC:H) - none of which point to trivial mass exploitation. The high confidentiality/integrity/availability impact reflects that bypassing the command allowlist yields command execution on the host, but reaching that state is gated. No EPSS probability, CISA KEV listing, SSVC exploitation value, or POC reference was supplied in the input, so there is no signal of active or probable exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' The vuln.today decision label is 'this_month,' which is consistent with the non-urgent signal set - treat as scheduled patching, not drop-everything. One caveat to verify: the input Tags label this 'Information Disclosure,' which conflicts with the description's 'command execution' and the full C:H/I:H/A:H impact - the real consequence is code/command execution, broader than disclosure.

An attacker who can influence what JetBrains Junie CLI processes - for example via a crafted project, prompt, or input that the user runs the agent against - supplies a command that slips past the incomplete allowlist validation (CWE-184), causing the CLI to execute an attacker-chosen command on the local host. Exploitation requires the victim to run the tool (UI:R) with at least low privileges (PR:L) and is non-trivial to arrange (AC:H). No public exploit was identified in the provided data.