CVE-2026-123831

CriticalCVSS 9.6/10Last modified Nov 7, 2026

Description

In JetBrains CLion before 2026.2, 2026.1.4 code execution was possible in Safe Mode via Meson project settings

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 6, 2026
Last modified
Nov 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1238329.6In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation databaseCVE-2026-1238333.6In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projectsCVE-2026-1238348.1In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service accountCVE-2026-1238355.9In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race conditionCVE-2026-1238368.8In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backupCVE-2026-1238377.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSCVE-2026-1238387.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form fileCVE-2026-1238394.7In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwardingCVE-2026-123848.8Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allows Privilege Abuse. This issue affects CVE-2026-1238404.7In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabsCVE-2026-1238417.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archiveCVE-2026-1238427.1In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives
CVE-2026-123831: Critical severity, CVSS 9.6 | Vulnix