JetBrains Junie CLI before 26.8.3 ran an untrusted project's MCP server configuration (CVE-2026-111091, 7.8); CVE published 2026-10-15

View raw markdownEdit on GitHub ↗

TL;DR

JetBrains Junie CLI before 26.8.3 loaded an untrusted project's MCP server configuration, and the vendor's CVE record says code execution was possible through it (CVE-2026-111091, JetBrains CNA, CVSS 3.1 7.8, AV:L/AC:L/PR:N/UI:R, published 2026-10-15). Junie CLI reads project-scope MCP servers from .junie/mcp/mcp.json at the project root, and its documentation says configurations imported from that file are enabled by default, so a repository could name the process the agent would start the first time a developer ran Junie inside it. The fix is in 26.8.3; the current release is 26.10.12 (2026-10-15), and the what's-new page for 26.10.5 (2026-10-06) lists "trusted project on start." The record's only reference is the vendor's fixed-issues page, which renders empty to a non-browser fetch, so the vendor's CVE record is the primary and single source. This is the .cursor/mcp.json class, in the JetBrains agent.

What happened

JetBrains published the record on 2026-10-15 with one sentence of description: "In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration." The affected entry is JetBrains Junie CLI, versions from 0 before 26.8.3 (semver), CVSS 3.1 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, no CWE, no credit, and a single reference to jetbrains.com/privacy-security/issues-fixed/. That page is rendered client-side and returned no table to this run's fetch, so the fixed-version claim rests on the CNA record, which is the vendor's own, and this file treats it as the vendor advisory per this corpus's rule for vendor-published CVE records.

The mechanism is stated by the product's documentation rather than by the record. Junie CLI's MCP configuration page says "Project scope: MCP server configs are stored in the .junie/mcp/mcp.json file at the root of your project" and "Manually added configurations are imported to the list of MCP servers and enabled by default." An MCP server entry is a command line the client spawns, so before 26.8.3 a cloned repository that shipped that file chose a process on the developer's machine, started when Junie started. The local vector and user interaction in the score are the clone and the launch. The vendor's what's-new page lists releases from 26.9.22 (2026-10-01) to 26.10.12 (2026-10-15); the 26.8.3 entry itself is not on the page this run could fetch, and the 26.10.5 (3579.5) entry of 2026-10-06 includes "trusted project on start," which reads as the user-facing side of the same change. What exactly 26.8.3 does when it meets an untrusted project (a prompt, a refusal to load, a restriction to user-scope servers) is not stated by any page this run opened; the record says only that the code-execution path is closed.

Two distribution notes. The npm package @jetbrains/junie-cli last published 1468.30.0 on 2026-04-27 and its version line (849.x, 888.x, 1468.x) does not map onto the record's 26.x range; the record names no package, so this file does not derive an "upgrade to" line for the npm artifact and notes only that it predates the fix and has not been updated. The product's own channel is the standalone CLI from junie.jetbrains.com, where the current version is 26.10.12.

The class is the one this corpus has recorded in each major agent in turn: a project-scope configuration file that names a program, honoured on open. Cursor's MCPoison (2025-07) was the first; VS Code's 2026-10-13 batch closed three Workspace Trust bypasses and an MCP sandbox gap in the same week this CVE was published; Junie's IDE plugin was in the IDEsaster cluster. The repair in every case is a trust decision that happens before the file is read, which is what the Junie what's-new entry describes.

Am I affected?

junie --version 2>/dev/null                 # below 26.8.3 = affected; 26.10.12 is current (2026-10-15)
# Does a project you opened ship its own MCP servers?
cat .junie/mcp/mcp.json 2>/dev/null         # any "command" entry you did not add is the repository's choice of process

Affected if Junie CLI below 26.8.3 was started inside a project you did not author that contained .junie/mcp/mcp.json. The @jetbrains/junie-cli npm line is older than the fix and has not been republished.

If you are affected

Update to the current Junie CLI. For each third-party project opened with an older version, read its .junie/mcp/mcp.json and, if it names a command you did not add, treat the machine as having run that command: inspect what it does, rotate tokens the user profile held (JetBrains account, Git, cloud, provider keys), and follow if-your-local-ai-agent-was-exploited.md. Remove the stale npm install if you still have one.

Prevention

  • Treat a repository's agent configuration (.junie/, .cursor/, .vscode/, .claude/) as code: read it before the agent does, and keep MCP servers in user scope unless the project is yours. mcp-hygiene.md.
  • Keep agents on their current channel. The CVE record (2026-10-15) arrived after the fix release it names, and no page this run could fetch dates 26.8.3, so the release notes were the only earlier signal.

Sources