CVE-2026-123832

CriticalCVSS 9.6/10Last modified Nov 7, 2026

Description

In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
JetBrainsCLion< 2026.2

References

Timeline

Published
Nov 6, 2026
Last modified
Nov 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1238333.6In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projectsCVE-2026-1238348.1In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service accountCVE-2026-1238355.9In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race conditionCVE-2026-1238368.8In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backupCVE-2026-1238377.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSCVE-2026-1238387.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form fileCVE-2026-1238394.7In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwardingCVE-2026-123848.8Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allows Privilege Abuse. This issue affects CVE-2026-1238404.7In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabsCVE-2026-1238417.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archiveCVE-2026-1238427.1In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archivesCVE-2026-1238433.3In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration
CVE-2026-123832: Critical severity, CVSS 9.6 | Vulnix