In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61…
Priority LOW 32CWE-356Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 information disclosure was possible via search_project function
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00217 12th percentileScored 2026-11-07
Fix Fixed Junie (JetBrains): 252.284.66,
251.284.66,
243.284.66,
252.284.61,
251.284.61,
243.284.61,
252.284.50,
252.284.54,
251.284.54,
251.284.50,
243.284.54,
243.284.50
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| JetBrains | Junie | before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 | 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 | Patch available | CNA |
- Junie VendorJetBrains Affected before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 Fixed in 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jetbrains:junie:*:*:*:*:*:*:*:* | before 243.284.50; 251.72.165 to before 251.284.50; 252.204.139 to before 252.284.50 | Vulnerable | JetBrains |
- cpe:2.3:a:jetbrains:junie:*:*:*:*:*:*:*:* Versions before 243.284.50; 251.72.165 to before 251.284.50; 252.204.139 to before 252.284.50 Vulnerable ·JetBrains
Remediation
- Fix · CNA Junie (JetBrains) Fixed in 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50
Timeline
- 2026-10-02 Threatist record created from CVE-2025-58335
- 2026-10-03 Alias added: GHSA-g74x-fxmv-p55j
References
More JetBrains Junie vulnerabilities
- TI-2025-37003 Command injection in JetBrains Junie CVSS 3.1CRITICAL 9.8
- TI-2026-29779 In JetBrains Junie before 252.549.29 command execution was possible via malicious project file CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-58335 · CVE Program
- CVE-2025-58335 · NVD
- FIRST EPSS
- GHSA-g74x-fxmv-p55j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences