Pycharm
Monthly
Code execution in JetBrains PyCharm before 2026.2.1 is possible through Jupyter MCP (Model Context Protocol) tools that expose critical functions without authentication. The root cause is CWE-306 (Missing Authentication for Critical Function) - the MCP tool surface in PyCharm's Jupyter integration fails to enforce any authentication check before executing code. Any local attacker able to reach the MCP endpoint can trigger arbitrary code execution with the privileges of the running PyCharm process, achieving full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis.
Arbitrary code execution in JetBrains PyCharm before 2026.1.4 and 2026.2 lets an attacker who supplies a crafted project achieve code execution when a victim opens that untrusted project in the IDE. PyCharm auto-selects or trusts a Python executable bundled or referenced by the project, so merely opening the malicious project runs attacker-controlled code with the user's privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the reporter is JetBrains itself and a vendor patch is available.
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible [CVSS 8.2 HIGH]
Cross-site scripting in JetBrains PyCharm's Quick Documentation rendering feature (before version 2026.2.1) enables code execution within the IDE process when a developer inspects documentation for a symbol from a maliciously crafted source. Attackers - including supply-chain adversaries embedding malicious HTML or JavaScript into Python package docstrings - can achieve code execution in PyCharm's local process context once the victim triggers Quick Documentation on an affected symbol. No public exploit has been identified at time of analysis, and JetBrains has released a fix in version 2026.2.1.
Stored XSS in JetBrains PyCharm's Jupyter notebook Markdown cell renderer allows a remote, unauthenticated attacker to execute arbitrary JavaScript in the context of a victim's PyCharm session by delivering a crafted notebook file. All PyCharm versions prior to 2025.3.4 are affected. The vulnerability carries no KEV listing and no public exploit has been identified at time of analysis, though the low attack complexity and lack of required privileges make opportunistic abuse via shared or repository-hosted notebooks plausible.
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible. Rated high severity (CVSS 7.7), this vulnerability is low attack complexity. No vendor patch available.
In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity. No vendor patch available.
In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Code execution in JetBrains PyCharm before 2026.2.1 is possible through Jupyter MCP (Model Context Protocol) tools that expose critical functions without authentication. The root cause is CWE-306 (Missing Authentication for Critical Function) - the MCP tool surface in PyCharm's Jupyter integration fails to enforce any authentication check before executing code. Any local attacker able to reach the MCP endpoint can trigger arbitrary code execution with the privileges of the running PyCharm process, achieving full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis.
Arbitrary code execution in JetBrains PyCharm before 2026.1.4 and 2026.2 lets an attacker who supplies a crafted project achieve code execution when a victim opens that untrusted project in the IDE. PyCharm auto-selects or trusts a Python executable bundled or referenced by the project, so merely opening the malicious project runs attacker-controlled code with the user's privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the reporter is JetBrains itself and a vendor patch is available.
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible [CVSS 8.2 HIGH]
Cross-site scripting in JetBrains PyCharm's Quick Documentation rendering feature (before version 2026.2.1) enables code execution within the IDE process when a developer inspects documentation for a symbol from a maliciously crafted source. Attackers - including supply-chain adversaries embedding malicious HTML or JavaScript into Python package docstrings - can achieve code execution in PyCharm's local process context once the victim triggers Quick Documentation on an affected symbol. No public exploit has been identified at time of analysis, and JetBrains has released a fix in version 2026.2.1.
Stored XSS in JetBrains PyCharm's Jupyter notebook Markdown cell renderer allows a remote, unauthenticated attacker to execute arbitrary JavaScript in the context of a victim's PyCharm session by delivering a crafted notebook file. All PyCharm versions prior to 2025.3.4 are affected. The vulnerability carries no KEV listing and no public exploit has been identified at time of analysis, though the low attack complexity and lack of required privileges make opportunistic abuse via shared or repository-hosted notebooks plausible.
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible. Rated high severity (CVSS 7.7), this vulnerability is low attack complexity. No vendor patch available.
In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible. Rated low severity (CVSS 3.5), this vulnerability is low attack complexity. No vendor patch available.
In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In JetBrains PyCharm 2019.2.5 and 2019.3 on Windows, Apple Notarization Service credentials were included. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
JetBrains PyCharm before 2019.2 was allocating a buffer of unknown size for one of the connection processes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.