In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports
JetBrains Datalore deployments before version 2026.2.4 are affected if they have published interactive reports accessible to unauthenticated users.
An attacker does not need authentication or user interaction, but exploitation requires access to a published interactive report. The attack complexity is rated high.
Successful exploitation can allow code execution and may result in high impact to confidentiality, integrity, and availability.
Upgrade JetBrains Datalore to version 2026.2.4 or later. If upgrading is not immediately possible, limit or disable unauthenticated access to published interactive reports.