CVE-2026-123855

HighCVSS 7.5/10Last modified Nov 7, 2026

Description

In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
JetBrainsToolbox App< 3.6.1

References

Timeline

Published
Nov 6, 2026
Last modified
Nov 7, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1238566.5In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development serverCVE-2026-1238574.3In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetectionCVE-2026-1238584.4In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projectsCVE-2026-1238598.1When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake ConCVE-2026-123863.9Improper null termination vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Overflow Buffers. ThisCVE-2026-1238605.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder alloCVE-2026-1238615.3Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchiCVE-2026-1238622.9An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlibCVE-2026-1238638.2A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A clCVE-2026-1238648.1A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys anCVE-2026-1238657.5An unauthenticated HTTP/2 client can permanently leak Node.js server memory and file descriptors. If a peer triggers a protocol error, for eCVE-2026-1238667.5A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other connections' response buffers,
CVE-2026-123855: High severity, CVSS 7.5 | Vulnix