CVE-2026-123279

CriticalCVSS 9.0/10Last modified Nov 10, 2026

Description

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
JetBrainsDatalore< 2026.4

References

Timeline

Published
Nov 6, 2026
Last modified
Nov 10, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-123288.1Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of theseCVE-2026-1232808.1In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reportsCVE-2026-1232817.5In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount brokerCVE-2026-1232827.4In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated sessionCVE-2026-1232836.8In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered accountCVE-2026-1232846.5In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared contentCVE-2026-1232858.8In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injectionCVE-2026-1232866.5In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session tokenCVE-2026-1232877.5In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reportsCVE-2026-1232885.4In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor linkCVE-2026-1232894.3In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify filesCVE-2026-123295.3Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12.
CVE-2026-123279: Critical severity, CVSS 9.0 | Vulnix