Jetbrains

In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.

In JetBrains YouTrack before 2026.2.18634, insufficient validation of role assignments allowed privilege escalation

In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible

In JetBrains YouTrack before 2026.1.13162 stored XSS in project notification templates was possible

In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint

In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content

In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible.

In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects.

In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.

In JetBrains Code With Me bundled to the compatible IDEs before version 2021.1, the client could execute code in read-only mode.

In JetBrains YouTrack before 2020.4.4701, CSRF via attachment upload was possible.

In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.

In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache privilege escalation vulnerability due to kotlin-main-kts cached scripts in the system temp directory, which is shared by all users by…

In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.

JetBrains YouTrack versions before 2019.1 had a CSRF vulnerability on the settings page.

A CSRF vulnerability was detected in one of the admin endpoints of JetBrains YouTrack. The issue was fixed in YouTrack 2018.4.49852.

In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools

In JetBrains ReSharper before 2025.2.4 missing signature verification in DPA Collector allows local privilege escalation

In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields

In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 code execution was possible due to improper command validation

In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces

In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible

In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint

In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access

In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible

In JetBrains YouTrack before 2025.3.104432 missing TLS certificate validation enabled data disclosure

In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves

In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorized API requests

In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific edge cases

JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC.

In several versions of JetBrains IntelliJ IDEA Ultimate, creating run configurations for cloud application servers leads to saving a cleartext unencrypted record of the server credentials in the IDE configuration files. If the Settings Repository plugin was then used and…

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution

In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible

In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion

In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider before 2024.3.4, 2024.2.8, and 2024.1.7, dotTrace before 2024.3.4, 2024.2.8, and 2024.1.7, ETW Host Service before 16.43, Local Privilege Escalation via the ETW Host Service was possible

In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible.

In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible.

In JetBrains PyCharm before 2020.3.4, local code execution was possible because of insufficient checks when getting the project from VCS.

In JetBrains IntelliJ IDEA 2020.3.3, local code execution was possible because of insufficient checks when getting the project from VCS.

In JetBrains IntelliJ IDEA before 2020.3, potentially insecure deserialization of the workspace model could lead to local code execution.

JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file.

JetBrains dotPeek before 2018.2 and ReSharper Ultimate before 2018.1.4 allow attackers to execute code by decompiling a compiled .NET object (such as a DLL or EXE file) with a specific file, because of Deserialization of Untrusted Data.