Insufficient Login Warning Enables Credential Leakage to Malicious Server in JetBrains Toolbox App

In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server

Command Injection via Enterprise Configuration URLs in JetBrains Toolbox App

In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs

In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server

In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover before 2026.3 and 2026.2.5, the jetbrainsd daemon trusted compromised intermediate certificates

In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible

In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation

In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible

In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin

In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible

In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image

JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler.

JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler.

In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file.

In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible.

JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.