CVE-2026-41153
Published: 17 April 2026
Summary
CVE-2026-41153 is a medium-severity Command Injection (CWE-77) vulnerability in Jetbrains Junie. Its CVSS base score is 5.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 0.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by requiring timely patching of JetBrains Junie to version 252.549.29 or later, eliminating the command injection vulnerability.
Prevents command injection by enforcing rigorous validation of untrusted inputs from malicious project files processed by the application.
Identifies systems affected by CVE-2026-41153 through vulnerability scanning, enabling targeted remediation of vulnerable JetBrains Junie installations.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection triggered by opening malicious project file directly enables T1204.002 (Malicious File under User Execution) for initial trigger and T1059 (Command and Scripting Interpreter) for arbitrary OS command execution.
NVD Description
In JetBrains Junie before 252.549.29 command execution was possible via malicious project file
Deeper analysisAI
CVE-2026-41153 is a command injection vulnerability (CWE-77) affecting JetBrains Junie versions prior to 252.549.29. The flaw enables arbitrary command execution when a user opens a malicious project file, as disclosed on April 17, 2026, with a CVSS v3.1 base score of 5.8 (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L).
Exploitation requires local access to the target system, high attack complexity, and user interaction, such as convincing a user to open a specially crafted project file in the affected JetBrains Junie instance; no privileges are needed. A successful attack can result in high confidentiality impact (e.g., unauthorized access to sensitive data), low integrity impact (limited data modification), and low availability impact (partial denial of service).
JetBrains has addressed the issue in version 252.549.29 and later, with details available in their security issues fixed advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. Practitioners should ensure affected installations are updated promptly to mitigate risks.
Details
- CWE(s)