VulnSocial

CVE-2026-111091

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-829

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-15: 110-15
Referenced assets1 URL
By indicator
Full discourse1 post
  • skinnyguinea@_skinnyguinea

    JetBrains' Junie CLI could run code from an untrusted repo's MCP server config. Fixed in 26.8.3 (CVE-2026-111091, CVSS 7.8). Its docs also say headless runs like CI skip the trust prompt and load a repo's MCP servers, hooks and skills by design. https://nvd.nist.gov/vuln/detail/CVE-2026-111091

    1000060
    123 followersView on X

Explore more

Back to dashboard