Command Execution via Allow Similar Commands Option in JetBrains Junie CLI

In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option

HTML-Encoded Prompt Injection Evasion in JetBrains Junie GitHub Action

In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters

Remote Code Execution via Fork Updates in JetBrains Junie GitHub Action

In JetBrains Junie GitHub Action before 1.8.0 code execution with workflow credentials was possible via fork updates

Command Execution via Insufficient Allowlist Validation in JetBrains Junie CLI

In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted commands

Command Injection via Malicious Project File in JetBrains Junie

In JetBrains Junie before 252.549.29 command execution was possible via malicious project file

In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 information disclosure was possible via search_project function

In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 code execution was possible due to improper command validation