Junie Trusted Project MCP on 3 August. The CVE Is Today.

JetBrains published CVE-2026-111091 at 15:29 UTC on 15 October 2026. The record says code execution was possible in Junie CLI before 26.8.3 via an untrusted project's MCP server configuration. The vendor page names the reporter syaifmax and the ticket JUNIE-3056. The weakness is CWE-829. CVSS 3.1 is 7.8, local, low complexity, no privileges, user interaction required, high confidentiality, integrity, and availability.

Hacker News tonight led with Muse Spark Open, a Fortran anniversary, and a study of prompt injection in HTTP headers. US X trends at 22:20 UTC were college football, celebrity, and politics. Muse Spark Open was on that list as a launch. Reuters in this window had no new operator control failure. The n8n Chat Hub role the day before is a separate brief. This one is the Junie project file.

High High because JetBrains scores code execution from a project the CLI loads, and because the public name arrived 73 days after the release that contains the trust sentence. CISA's enrichment at 16:05 UTC says exploitation none. The path is local and needs a user action. It is not an unauthenticated remote bug.

The configuration traveled with the project.#

Junie CLI is JetBrains' terminal coding agent. The CVE record, which JetBrains assigned, states that code execution was possible before 26.8.3 through an untrusted project's MCP server configuration. CWE-829 is the inclusion of functionality from a control sphere the program does not trust. The affected range is every release before 26.8.3. JetBrains does not name an introduced build.

The score says the path is local and needs one user action. Opening a project you did not write is the shape that matches that vector. This brief does not describe the configuration syntax, the load order, or a payload. JetBrains did not publish those either.

The same issues list, published 15 October, also names Datalore, TeamCity, and YouTrack flaws. Those products are not this CLI, and their tickets are not JUNIE-3056.

The package clock is 3 August.#

GitHub release 26.8.3, build 2548.5, published at 18:06 UTC on 3 August 2026. It is not a prerelease. The note's first sentence is: added project trust verification before loading MCP servers, skills, commands, and project configuration. The other sentence is terminal theme detection. Neither sentence names CVE-2026-111091, CWE-829, or syaifmax.

The release immediately before it is 26.7.27, build 2470.4, published at 16:23 UTC on 28 July. JetBrains marks that release, and every earlier one, as before the fix. The 3 August note is the first release note that states the trust check. This brief did not diff the binary.

The disclosure clock is the CVE timestamp, 15:29 UTC on 15 October, 73 days after 3 August. The issues page uses the same publication date, 15 October. CISA added SSVC at 16:05 UTC: exploitation none, automatable no, technical impact total.

The release channel's current build is not 26.8.3. 26.10.12, build 3659.6, published at 14:52 UTC today, about 37 minutes before the CVE. Its note is Figma MCP support. It is a later build than 2548.5. It is not the note that added the trust sentence. The version list the release-channel installer reads ends at 3659.6 tonight. Nightly tags on the release repository use higher build numbers and are not that list.

1. 2026-07-28
   Junie CLI 26.7.27, build 2470.4, publishes at 16:23 UTC. JetBrains later marks every build before 26.8.3 affected.
2. 2026-08-03
   26.8.3, build 2548.5, publishes at 18:06 UTC. The note adds project trust checks before MCP servers load. It does not name a CVE.
3. 2026-10-15
   26.10.12, build 3659.6, publishes at 14:52 UTC. The note is Figma MCP support. CVE-2026-111091 publishes at 15:29 UTC. CISA says exploitation none at 16:05 UTC.

What to do if the CLI is still below 26.8.3.#

Compare the version you run with 26.8.3, build 2548.5. If it is that release or a later one, JetBrains already names you past the affected range. The work left is to know that the public record is new, not the package. If the CLI is older, move to the current release channel. Tonight that build is 26.10.12.

Until an older CLI is updated, do not point it at a repository you do not trust. The configuration JetBrains describes is the project's, not a setting that lives only in your home directory. Read the MCP server configuration a cloned project ships before you let the agent act on it. That is a review of what you are about to load. It is not a procedure for triggering the bug, and this brief will not add one.

The 3 August note also covers skills, commands, and project configuration, which the CVE sentence does not. Treat the CVE as the MCP claim JetBrains published, and the release note as the broader trust check they shipped. Do not file Figma support on 26.10.12 as the remediation note.

CISA says exploitation none. That is not a reason to leave a CLI below 26.8.3 on a laptop that opens other people's trees. The impact window for anyone who took 26.8.3 in August closed on 3 August. The impact window for a pinned older build is still open, and the disclosure clock started today.