{"id":"CVE-2026-123279","published":"2026-11-06T11:17:06.140","lastModified":"2026-11-10T19:20:38.893","description":"In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators","cvssScore":9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"In JetBrains Datalore before version 2026.4, view-only collaborators could execute arbitrary code within notebook computations due to insufficient authorization checks (CWE-863), allowing full compromise of confidentiality, integrity, and availability.","exploitability":"Exploitation requires low skill and only a valid authenticated account with view-only permissions in a shared notebook; user interaction (e.g., opening the notebook) is required.","blast_radius":"Successful exploitation grants attackers full control over the computation environment, potentially affecting all data and resources accessible to the Datalore service, including sensitive notebooks and backend systems.","remediation":"Upgrade to JetBrains Datalore 2026.4 or later, which patches the authorization flaw allowing view-only users to trigger code execution.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","auth-bypass","web","collaborative-platform"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:48:01.794Z"}}