Rider
Monthly
JetBrains Rider versions before 2026.2.1 allow the bundled AI Assistant to silently auto-update third-party skills - downloaded plugin-style capability packages that extend the assistant - without prompting the user or verifying the integrity of the update, enabling an attacker who controls or compromises a skill source the developer already trusts to push malicious skill content into the IDE. Exploitation is constrained: it requires the victim to run an affected Rider build with AI Assistant enabled and at least one third-party skill installed from an attacker-influenceable source, which is why the vector carries high attack complexity (AC:H) and only low confidentiality and integrity impact with no availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) applies; a vendor patch is available in Rider 2026.2.1.
Local privilege escalation in JetBrains ReSharper, Rider, and dotTrace before 2025.2.5 lets an attacker who already holds a low-privileged local account win a time-of-check-to-time-of-use race condition against a higher-privileged operation and gain that operation's privileges on the same host. The issue is rated 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H), meaning it is authenticated-local and non-deterministic - typically requiring repeated attempts - and no public exploit identified at time of analysis (EPSS 0.00%, not in CISA KEV). Realistic exposure is limited to multi-user or developer endpoints where the tool or its elevated helper, installer, or updater is present.
In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local. Rated high severity (CVSS 7.8). No vendor patch available.
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
JetBrains Rider versions before 2026.2.1 allow the bundled AI Assistant to silently auto-update third-party skills - downloaded plugin-style capability packages that extend the assistant - without prompting the user or verifying the integrity of the update, enabling an attacker who controls or compromises a skill source the developer already trusts to push malicious skill content into the IDE. Exploitation is constrained: it requires the victim to run an affected Rider build with AI Assistant enabled and at least one third-party skill installed from an attacker-influenceable source, which is why the vector carries high attack complexity (AC:H) and only low confidentiality and integrity impact with no availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) applies; a vendor patch is available in Rider 2026.2.1.
Local privilege escalation in JetBrains ReSharper, Rider, and dotTrace before 2025.2.5 lets an attacker who already holds a low-privileged local account win a time-of-check-to-time-of-use race condition against a higher-privileged operation and gain that operation's privileges on the same host. The issue is rated 7.0 (AV:L/AC:H/PR:L/UI:N, C:H/I:H/A:H), meaning it is authenticated-local and non-deterministic - typically requiring repeated attempts - and no public exploit identified at time of analysis (EPSS 0.00%, not in CISA KEV). Realistic exposure is limited to multi-user or developer endpoints where the tool or its elevated helper, installer, or updater is present.
In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug session. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local. Rated high severity (CVSS 7.8). No vendor patch available.
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains Rider before 2022.2 Trust and Open Project dialog could be bypassed, leading to local code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In JetBrains Rider versions 2019.3 EAP2 through 2019.3 EAP7, there were unsigned binaries provided by the Windows installer. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.