What is the CVSS score of EUVD-2026-48252?

EUVD-2026-48252 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Python are affected by EUVD-2026-48252?

CVE-2026-65908 in JetBrains PyCharm enables arbitrary code execution when developers open untrusted projects, as the IDE automatically executes bundled Python interpreters without user consent.. A patch is available.

How to fix or mitigate EUVD-2026-48252?

Within 24 hours, inventory all PyCharm installations across development and CI/CD environments to identify affected versions. Within 7 days, upgrade all PyCharm instances to version 2026.1.4 or later in the 2026.1 branch, or 2026.2 or later in the 2026.2 branch, per JetBrains guidance. Within 30 days, audit recent projects opened in formerly affected PyCharm versions, review external project sources for unauthorized modifications, and conduct security awareness training emphasizing the risks of opening untrusted projects.

Python EUVD-2026-48252

| CVE-2026-65908 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-07-23 JetBrains

GHSA-2j8g-fr3j-fp7c

RCE Python Pycharm JetBrains

8.6

CVSS 3.1 · Vendor: JetBrains

Severity by source

Vendor (JetBrains) PRIMARY

8.6 HIGH

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from Vendor (JetBrains) · only source for this CVE.

CVSS VectorVendor: JetBrains

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 23, 2026 - 14:04 EUVD

Analysis Generated

Jul 23, 2026 - 13:16 vuln.today

CVE Published

Jul 23, 2026 - 12:25 cve.org

HIGH 8.6

DescriptionCVE.org

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open

Articles & Coverage 1

News 3 New Python Vulnerabilities - 1 Critical, 2 High Severity Jul 24, 2026

AnalysisAI

Arbitrary code execution in JetBrains PyCharm before 2026.1.4 and 2026.2 lets an attacker who supplies a crafted project achieve code execution when a victim opens that untrusted project in the IDE. PyCharm auto-selects or trusts a Python executable bundled or referenced by the project, so merely opening the malicious project runs attacker-controlled code with the user's privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the reporter is JetBrains itself and a vendor patch is available.