In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default

Arbitrary Code Execution via Untrusted Project-Local Package Manager in WebStorm

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration

Unauthorized Input Injection in IntelliJ IDEA Remote Development

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open

CSS Injection via Mermaid Diagrams in YouTrack

In JetBrains YouTrack before 2026.2.17012 cSS injection via Mermaid diagram rendering was possible

Path Traversal in IntelliJ IDEA Enables Code Execution

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

Stored XSS via agent‑reported data on TeamCity cloud profile page

In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data

Stored XSS via article titles in digest emails in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.17394 stored XSS via article titles in digest emails was possible

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration

In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible

In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks

Improper Authorization in YouTrack Project Configuration Endpoint

In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings

Excessive User Profile Data Exposure through Default Role Configuration

In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details

Improper Access Control Allows Read Access to Saved Queries and Tags

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

Prototype Pollution in JetBrains YouTrack Websandbox Bridge Before 2026.2.16593

In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack

Improper Access Control in JetBrains YouTrack Exposes User Private Data via Comment Templates Endpoint

In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint