CVE-2025-43012 is a high severity (CVSS 8.3) command injection in the SSH plugin of the JetBrains Toolbox App. Versions before 2.6 are affected. The fix is to update the Toolbox App to version 2.6 or later, then confirm the installed version on each developer machine.
What's affected
JetBrains Toolbox App before version 2.6, per the record. The record says command injection in the SSH plugin was possible, and it gives no further technical detail. JetBrains lists the issue on its security issues fixed page, which is the reference named in the record.
The weakness is tagged CWE-77, improper neutralization of special elements used in a command. The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. That reads as network based, high attack complexity, no privileges, user interaction required, and a changed scope with high impact. In plain terms, someone has to do something, such as connecting to a remote host, for the issue to come into play.
Fixed version: 2.6, based on the record's wording of "before 2.6". Confirm the exact release notes on the JetBrains page.
How to check if you're exposed
The Toolbox App shows its own version in its settings or about section. Open it on a developer machine and compare with 2.6.
For a fleet, ask your software inventory or device management tool for the installed version. On macOS you can read it from the app bundle:
defaults read "/Applications/JetBrains Toolbox.app/Contents/Info" CFBundleShortVersionString
On Windows, check the version in the installed apps list. If the Toolbox App's SSH plugin is not in use on a machine, the exposure is likely lower, but updating is still the cleanest fix.
What to do now
- List developer machines that run the JetBrains Toolbox App.
- Update each one to version 2.6 or later. The Toolbox App can update itself, and managed fleets can push a newer installer.
- Confirm the new version after the update, not just the update status.
- Until then, avoid connecting the SSH plugin to hosts you do not control.
- Add the Toolbox App to your normal developer tooling patch routine, since it manages IDE installs as well.
- Review the JetBrains security issues page for other fixes released at the same time.
Try it yourself
This demo walks through a dependency inventory, the kind of step that helps with findings like this one.
Click through it at your own pace, or open it full screen.
Why it matters
Developer tools run with the developer's own rights. They often hold SSH keys, cloud credentials and access to source code. A command injection flaw in a tool that opens remote connections is worth taking seriously because the machine it runs on is a stepping stone to many other systems.
The record does not flag the CVE as listed in CISA's Known Exploited Vulnerabilities catalog (KEV), and it does not say that it has been used in attacks. This is an ordinary patching item, not an emergency, but developer laptops are a common target and the fix is simple.
Quick check
Which version fixes CVE-2025-43012?
The record says versions before 2.6 are affected, so 2.6 or later is the target. Confirm on the JetBrains security issues fixed page.
Do I need to update my IDEs as well?
The record names only the Toolbox App. Check the JetBrains advisory for any IDE related fixes shipped in the same period.
Sources
- Gold entry for CVE-2025-43012
- Gold entry for CWE-77
- JetBrains security issues fixed, listed in the CVE record
I tried to read the JetBrains page and could not extract the entry for this CVE, so the details above come from the record itself.
Last reviewed: 18 October 2026.
