JVM Options Injection Enables Command Execution in JetBrains Datalore Database Tasks

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection

Improper Authorization Enables Retrieval of Notebook Owner's File Storage Session Token

In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token

Unauthorized Download of Private Notebook Files via Published Interactive Reports in JetBrains Datalore

In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

Stored Cross‑Site Scripting via Vega Editor Link in JetBrains Datalore

In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link

Improper Authorization in JetBrains Datalore Allowing File Modification by Notebook Viewers

In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files

Hidden Notebook Code Exposure via Public Endpoint

In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint

Improper owner validation in JetBrains Datalore allows cross‑workspace data reading

In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook

Workspace Collaborators Retrieve Owner's SSH Private Key via Git Backup in JetBrains Datalore

In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup

Code Execution Through Init Script Upload Race in JetBrains Datalore

In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition

Improper Scope Validation in JetBrains Datalore Allows Cross‑Workspace Service Account Abuse

In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account

Persisting API Tokens and Sessions for Removed or Banned Users in JetBrains Datalore

In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid

Improper Authorization Allows View‑Only Collaborators to Modify Shared Content in JetBrains Datalore

In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content

SSO-Based Account Takeover in JetBrains Datalore Prior to 2026.4

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account

Inadequate Token Expiration Validation Allows Persistent Session Creation

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session

Notebook Code Execution via Sidecar Container Mount Broker in JetBrains Datalore

In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker

Unauthenticated Remote Code Execution via Published Interactive Reports in JetBrains Datalore

In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports

Execution by View‑Only Collaborators in JetBrains Datalore

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators

Unauthenticated Path Traversal in JetBrains Datalore Report Blob Endpoint

In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files

In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings