CVE-2026-111091: High severity JetBrains Junie CLI vulnerability
Published Oct 15, 2026
·Updated
In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration
Affected Software
1 affected component
JetBrains Junie CLI<26.8.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JetBrains Junie CLIto a version that resolves this vulnerability.Fixed in 26.8.3
Event History
Oct 15, 2026
CVE Published
via MITRE·03:29 PM
Data Sourced
via MITRE·03:29 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which environments are exposed?
JetBrains Junie CLI versions before 26.8.3 are affected when they handle an untrusted project's MCP server configuration.
2
What does an attacker need to exploit this issue?
The attacker needs to provide a project with an untrusted MCP server configuration and requires user interaction. No privileges are required for exploitation.
3
What is the practical impact of successful exploitation?
Successful exploitation can result in code execution and may compromise confidentiality, integrity, and availability.
4
What is the available remediation?
Update JetBrains Junie CLI to version 26.8.3 or later.