--- id: 2026-10-jetbrains-junie-cli-untrusted-project-mcp-config-code-execution-cve-2026-111091 title: "JetBrains Junie CLI before 26.8.3 ran an untrusted project's MCP server configuration (CVE-2026-111091, 7.8); CVE published 2026-10-15" date_disclosed: 2026-10-15 last_updated: 2026-10-16 severity: high status: patched ecosystems: [jetbrains, coding-agents, mcp] tools_affected: ["JetBrains Junie CLI before 26.8.3; current release 26.10.12 (2026-10-15)", "developers who open a cloned or downloaded project with Junie CLI", "the npm package @jetbrains/junie-cli, last published as 1468.30.0 on 2026-04-27, is an older distribution line whose relation to the 26.x range the record does not state"] tags: [cve, junie, jetbrains, mcp, mcp-json, untrusted-project, project-trust, code-execution, coding-agent, vendor-cna, single-source-vendor, patched] --- ## TL;DR JetBrains Junie CLI before 26.8.3 loaded an untrusted project's MCP server configuration, and the vendor's CVE record says code execution was possible through it (CVE-2026-111091, JetBrains CNA, CVSS 3.1 7.8, `AV:L/AC:L/PR:N/UI:R`, published 2026-10-15). Junie CLI reads project-scope MCP servers from `.junie/mcp/mcp.json` at the project root, and its documentation says configurations imported from that file are enabled by default, so a repository could name the process the agent would start the first time a developer ran Junie inside it. The fix is in 26.8.3; the current release is 26.10.12 (2026-10-15), and the what's-new page for 26.10.5 (2026-10-06) lists "trusted project on start." The record's only reference is the vendor's fixed-issues page, which renders empty to a non-browser fetch, so the vendor's CVE record is the primary and single source. This is the `.cursor/mcp.json` class, in the JetBrains agent. ## What happened JetBrains published the record on 2026-10-15 with one sentence of description: "In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configuration." The affected entry is `JetBrains Junie CLI`, versions from 0 before 26.8.3 (semver), CVSS 3.1 7.8 with vector `AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`, no CWE, no credit, and a single reference to `jetbrains.com/privacy-security/issues-fixed/`. That page is rendered client-side and returned no table to this run's fetch, so the fixed-version claim rests on the CNA record, which is the vendor's own, and this file treats it as the vendor advisory per this corpus's rule for vendor-published CVE records. The mechanism is stated by the product's documentation rather than by the record. Junie CLI's MCP configuration page says "Project scope: MCP server configs are stored in the `.junie/mcp/mcp.json` file at the root of your project" and "Manually added configurations are imported to the list of MCP servers and enabled by default." An MCP server entry is a command line the client spawns, so before 26.8.3 a cloned repository that shipped that file chose a process on the developer's machine, started when Junie started. The local vector and user interaction in the score are the clone and the launch. The vendor's what's-new page lists releases from 26.9.22 (2026-10-01) to 26.10.12 (2026-10-15); the 26.8.3 entry itself is not on the page this run could fetch, and the 26.10.5 (3579.5) entry of 2026-10-06 includes "trusted project on start," which reads as the user-facing side of the same change. What exactly 26.8.3 does when it meets an untrusted project (a prompt, a refusal to load, a restriction to user-scope servers) is not stated by any page this run opened; the record says only that the code-execution path is closed. Two distribution notes. The npm package `@jetbrains/junie-cli` last published 1468.30.0 on 2026-04-27 and its version line (849.x, 888.x, 1468.x) does not map onto the record's 26.x range; the record names no package, so this file does not derive an "upgrade to" line for the npm artifact and notes only that it predates the fix and has not been updated. The product's own channel is the standalone CLI from junie.jetbrains.com, where the current version is 26.10.12. The class is the one this corpus has recorded in each major agent in turn: a project-scope configuration file that names a program, honoured on open. [Cursor's MCPoison (2025-07)](2025-07-cursor-curxecute-mcpoison.md) was the first; [VS Code's 2026-10-13 batch](2026-10-vscode-1-141-1-ten-cve-batch-profile-import-rce-workspace-trust-agent-hook-mcp-sandbox.md) closed three Workspace Trust bypasses and an MCP sandbox gap in the same week this CVE was published; Junie's IDE plugin was in [the IDEsaster cluster](2026-06-idessaster-ai-ide-cve-cluster.md). The repair in every case is a trust decision that happens before the file is read, which is what the Junie what's-new entry describes. ## Am I affected? ```bash junie --version 2>/dev/null # below 26.8.3 = affected; 26.10.12 is current (2026-10-15) # Does a project you opened ship its own MCP servers? cat .junie/mcp/mcp.json 2>/dev/null # any "command" entry you did not add is the repository's choice of process ``` Affected if Junie CLI below 26.8.3 was started inside a project you did not author that contained `.junie/mcp/mcp.json`. The `@jetbrains/junie-cli` npm line is older than the fix and has not been republished. ## If you are affected Update to the current Junie CLI. For each third-party project opened with an older version, read its `.junie/mcp/mcp.json` and, if it names a command you did not add, treat the machine as having run that command: inspect what it does, rotate tokens the user profile held (JetBrains account, Git, cloud, provider keys), and follow [if-your-local-ai-agent-was-exploited.md](../playbooks/if-your-local-ai-agent-was-exploited.md). Remove the stale npm install if you still have one. ## Prevention - Treat a repository's agent configuration (`.junie/`, `.cursor/`, `.vscode/`, `.claude/`) as code: read it before the agent does, and keep MCP servers in user scope unless the project is yours. [mcp-hygiene.md](../prevention/mcp-hygiene.md). - Keep agents on their current channel. The CVE record (2026-10-15) arrived after the fix release it names, and no page this run could fetch dates 26.8.3, so the release notes were the only earlier signal. ## Sources - [CVE-2026-111091, CVE Services record (JetBrains CNA)](https://cveawg.mitre.org/api/cve/CVE-2026-111091) — published 2026-10-15; affected range, 7.8 vector, the one-sentence description, the single reference; fetched 2026-10-16. - [JetBrains, fixed security issues](https://www.jetbrains.com/privacy-security/issues-fixed/) — the record's reference; client-rendered, returned no table to this run's fetch. - [Junie CLI documentation, add and configure MCP servers](https://junie.jetbrains.com/docs/junie-cli-mcp-configuration.html) — `.junie/mcp/mcp.json` at the project root; imported configurations enabled by default; no mention of trust. - [Junie CLI, what's new](https://junie.jetbrains.com/whats-new) — releases 26.9.22 (2026-10-01) through 26.10.12 (2026-10-15); the 26.10.5 "trusted project on start" line; the 26.8.3 entry is not on the page. - `npm view @jetbrains/junie-cli time`, run 2026-10-16 — 1468.30.0 on 2026-04-27 is the newest publish of the npm line.