CVE-2026-123852

HighCVSS 7.4/10Last modified Nov 6, 2026

Description

In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 6, 2026
Last modified
Nov 6, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1238537.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the buildCVE-2026-1238545.5In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget moduleCVE-2026-1238557.5In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLsCVE-2026-1238566.5In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development serverCVE-2026-1238574.3In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetectionCVE-2026-1238584.4In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projectsCVE-2026-1238598.1When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake ConCVE-2026-123863.9Improper null termination vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Overflow Buffers. ThisCVE-2026-1238605.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder alloCVE-2026-1238615.3Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchiCVE-2026-1238622.9An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlibCVE-2026-1238638.2A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A cl
CVE-2026-123852: High severity, CVSS 7.4 | Vulnix