Command injection in JetBrains Junie
Priority MEDIUM 43CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.
Summary
In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 code execution was possible due to improper command validation
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00482 41st percentileScored 2026-11-07
Fix Fixed Junie (JetBrains): 252.284.66,
251.284.66,
243.284.66,
252.284.61,
251.284.61,
243.284.61,
252.284.50,
252.284.54,
251.284.54,
251.284.50,
243.284.54,
243.284.50
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| JetBrains | Junie | before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 | 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 | Patch available | CNA |
- Junie VendorJetBrains Affected before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 Fixed in 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:jetbrains:junie:*:*:*:*:*:*:*:* | before 243.284.50; 251.72.165 to before 251.284.50; 252.204.139 to before 252.284.50 | Vulnerable | JetBrains |
- cpe:2.3:a:jetbrains:junie:*:*:*:*:*:*:*:* Versions before 243.284.50; 251.72.165 to before 251.284.50; 252.204.139 to before 252.284.50 Vulnerable ·JetBrains
Remediation
- Fix · CNA Junie (JetBrains) Fixed in 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59458
- 2026-10-03 Alias added: GHSA-53j9-8fm4-3gf5
References
More JetBrains Junie vulnerabilities
- TI-2026-29779 In JetBrains Junie before 252.549.29 command execution was possible via malicious project file CVSS 3.1CRITICAL 9.8
- TI-2025-36128 In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61… CVSS 3.1HIGH 7.5
Sources
- CVE-2025-59458 · CVE Program
- CVE-2025-59458 · NVD
- FIRST EPSS
- GHSA-53j9-8fm4-3gf5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences