In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators
A collaborator with view-only access to a notebook can exploit the issue. Exploitation requires that the collaborator interact with the notebook's computation.
Successful exploitation can result in code execution in the notebook's computation. The reported impact includes high confidentiality, integrity, and availability consequences, with scope changed.
JetBrains Datalore versions before 2026.4 are affected. Updating to version 2026.4 or later addresses the affected version range.
The available information identifies view-only collaborators as the exploiting party. It does not indicate that unauthenticated users can exploit the issue.