CVE-2026-123855: OS Command Injection

Published Nov 6, 2026

Updated

In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade JetBrains Toolbox App to a version that resolves this vulnerability.
Fixed in 3.6.1

Event History

Nov 6, 2026

CVE Published

via MITRE·04:10 PM

Data Sourced

via MITRE·04:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

JetBrains Toolbox App installations running a version earlier than 3.6.1 are affected where enterprise configuration URLs are used.

What does an attacker need to exploit this issue?

Exploitation is possible through enterprise configuration URLs. The available information does not specify additional authentication, user-interaction, or network requirements.

What should teams do if they use enterprise configuration URLs?

Update JetBrains Toolbox App to version 3.6.1 or later. Until then, limit use of and changes to enterprise configuration URLs where possible.

CVE-2026-123855: OS Command Injection

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What should teams do if they use enterprise configuration URLs?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What should teams do if they use enterprise configuration URLs?