CVE-2026-41153

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

In JetBrains Junie before 252.549.29 command execution was possible via malicious project file

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
JetBrainsJunie< 252.549.29

References

Timeline

Published
Apr 17, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-411547.8Software installed and run as a non-privileged user may cause OOB kernel memory reads or writes through GPU API calls. When indexing pageCVE-2026-411555.5An attacker could cooperatively pass data from one secure GPU process to another secure GPU process through shared secure memory allocationsCVE-2026-411567.7Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources creating a wriCVE-2026-411579.8A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger an out-of-bound write in the GPU useCVE-2026-411587.8Software installed and run as a non-privileged user may conduct GPU system calls to write to arbitrary freed physical pages. Physical memCVE-2026-411595.3Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.6 and 11.15.0, MermaiCVE-2026-41167.2Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/CCVE-2026-411604.3EspoCRM is an open source customer relationship management application. Prior to 9.3.5, a business logic flaw (Broken Access Control) in EspCVE-2026-411615.3Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.2.0, the /api/autCVE-2026-411637.0bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mCVE-2026-411644.4nuts-node is the reference implementation of the Nuts specification. Prior to 6.2.3 and 5.4.31, the v1 access token introspection endpoint (CVE-2026-411667.0OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one Keycloak realm can ca
CVE-2026-41153: Critical severity, CVSS 9.8 | Vulnix