CVE-2026-41153 is a command execution flaw in JetBrains Junie, scored CVSS 5.8. A malicious project file could cause commands to run in versions before 252.549.29. Update Junie, and open only projects you trust. The score is medium because a user must open the project, and the issue is local. Updating is quick.
What's affected
- Affected: JetBrains Junie before 252.549.29
- Fixed: 252.549.29
The record is short: command execution was possible via a malicious project file. The JetBrains issues fixed page is a long list and did not return detail for this entry in my fetch, so I cannot describe the mechanism further. The CVSS vector needs local access and user interaction.
How to check if you're exposed
Open the plugin or tool settings in your JetBrains IDE and read the Junie version, then compare it with 252.549.29. You can also check the Plugins page in the IDE for an available update. Do the same on build machines and shared developer images where the IDE is installed.
What to do now
- Update Junie to 252.549.29 or later.
- Update the IDE as well, since JetBrains lists IDE fixes on the same page.
- Only open projects from sources you trust, and use restricted or safe mode for others where the IDE offers it.
- Keep secrets out of environments where you open unknown repositories.
Why it matters
The weakness is CWE-77, command injection. A file that looks like project data is treated as something that can cause a command to run. AI coding assistants are especially exposed to this pattern, since they read project files and may act on what they contain.
The score is medium because the user has to open the project. Developer machines still hold credentials and source code, so keep tools current. The record does not flag exploitation in the wild.
Quick check
Is opening a project enough?
The record says user interaction is required and that a malicious project file is the route. Treat unknown repositories as untrusted.
Sources
Last reviewed: 19 October 2026.
