CVE-2026-25847

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25847", "assignerOrgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "state": "PUBLISHED", "assignerShortName": "JetBrains", "dateReserved": "2026-02-06T14:16:37.003Z", "datePublished": "2026-02-09T10:39:00.791Z", "dateUpdated": "2026-02-26T15:04:15.134Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "shortName": "JetBrains", "dateUpdated": "2026-02-09T10:39:00.791Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79", "cweId": "CWE-79"}]}], "affected": [{"vendor": "JetBrains", "product": "PyCharm", "versions": [{"version": "0", "status": "affected", "lessThan": "2025.3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible"}], "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25847", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:56:14.410957Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:15.134Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25847", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:56:14.410957Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-09T13:44:07.100Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "JetBrains", "product": "PyCharm", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "descriptions": [{"lang": "en", "value": "In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79"}]}], "providerMetadata": {"orgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "shortName": "JetBrains", "dateUpdated": "2026-02-09T10:39:00.791Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25847", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:04:15.134Z", "dateReserved": "2026-02-06T14:16:37.003Z", "assignerOrgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "datePublished": "2026-02-09T10:39:00.791Z", "assignerShortName": "JetBrains"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PyCharm", "vendor": "JetBrains", "versions": [{"lessThan": "2025.3.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@jetbrains.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jetbrains:pycharm:*:*:*:*:*:*:*:*", "matchCriteriaId": "36BCB182-4C2F-4C50-8A9A-BDF148B39C0F", "versionEndExcluding": "2025.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible"}, {"lang": "es", "value": "En JetBrains PyCharm antes de 2025.3.2 un XSS basado en DOM en la p\u00e1gina del visor de Jupyter era posible"}], "id": "CVE-2026-25847", "lastModified": "2026-06-17T10:25:19.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 6.0, "source": "cve@jetbrains.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25847", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T04:56:14.410957Z", "version": "2.0.3"}}]}, "published": "2026-02-09T11:16:15.003", "references": [{"source": "cve@jetbrains.com", "tags": ["Vendor Advisory"], "url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "sourceIdentifier": "cve@jetbrains.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cve@jetbrains.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2025.3.2)"}}], "product": "pycharm", "vendor": "jetbrains"}], "analysis": {"en": {"generated_at": "2026-04-17T21:28:11.802305+00:00", "value": {"mitigation_remediation": ["Update PyCharm to version 2025.3.2 or later to apply the XSS fix.", "If an immediate update is not possible, disable the Jupyter notebook viewer feature or restrict access to untrusted notebooks so that malicious content cannot be loaded.", "Configure project settings to limit file types or run the viewer in a safe mode to prevent arbitrary script execution."], "summary": {"action": "Patch", "impact": "DOM\u2011based XSS in PyCharm Jupyter viewer"}, "threat_synthesis": {"affected_systems": "Any installation of JetBrains PyCharm that includes the Jupyter notebook viewer and is earlier than 2025.3.2 is affected, including community and professional editions used by developers working with Jupyter notebooks.", "description_and_impact": "The vulnerability is a DOM\u2011based cross\u2011site scripting flaw in the Jupyter notebook viewer of JetBrains PyCharm before version 2025.3.2. The flaw allows a crafted notebook or an attacker who can inject malicious script into the viewer's JavaScript context to run arbitrary code in the developer\u2019s browser. This can lead to disclosure of local credentials, device compromise, or malicious modification of the development environment.", "risk_and_exploitability": "The flaw scored 8.2 on CVSS and has an EPSS of less than 1\u202f%, meaning it is exploitable but not widely targeted yet. It is not currently listed in the CISA KEV catalog. The likely attack vector is local: an attacker would need to deliver a malicious notebook or influence a trusted user to open an infected file. The weakness aligns with CWE\u201179 and can be mitigated by applying the vendor patch or disabling the feature."}}}}, "created": "2026-02-10T12:23:42.276125+00:00", "title": "DOM\u2011based XSS in PyCharm Jupyter Viewer", "updated": "2026-04-17T21:30:28.393552+00:00", "vendors": ["jetbrains", "jetbrains$PRODUCT$pycharm"]}