CVE-2025-59458

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 code execution was possible due to improper command validation

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
JetBrains	Junie	< 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50

References

https://www.jetbrains.com/privacy-security/issues-fixed/Vendor Advisory

Timeline

Published: Sep 17, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-594597.5An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of ava CVE-2025-59467.2Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Polle CVE-2025-594607.5The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting a CVE-2025-594619.8A remote unauthenticated attacker may use the unauthenticated C++ API to access or modify sensitive data and disrupt services.CVE-2025-594627.5An attacker who tampers with the C++ CLI client may crash the UpdateService during file transfers, disrupting updates and availability.CVE-2025-594637.5An attacker may cause chunk-size mismatches that block file transfers and prevent subsequent transfers.CVE-2025-594647.5A memory leak in Node.js’s OpenSSL integration occurs when converting `X.509` certificate fields to UTF-8 without freeing the allocated buff CVE-2025-594657.5A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` er CVE-2025-594667.5We have identified a bug in Node.js error handling where "Maximum call stack size exceeded" errors become uncatchable when `async_hooks.crea CVE-2025-594679.6A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation CVE-2025-594689.1This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious passwor CVE-2025-594699.0This vulnerability allows a Backup or Tape Operator to write files as root.