# Junie Trusted Project MCP on 3 August. The CVE Is Today. > The primary is JetBrains. CVE-2026-111091, published on 15 October 2026, says Junie CLI before 26.8.3 could run code from an untrusted project's MCP server configuration. GitHub release 26.8.3, build 2548.5, published on 3 August and added project trust checks before loading those servers. The note does not name the CVE. CISA records exploitation as none. Source: https://hackerlogs.com/blog/junie-cli-mcp-trust-clock Published: 2026-10-15 ## Key takeaways - The primary is JetBrains. CVE-2026-111091 was published at 15:29 UTC on 15 October. Reporter syaifmax, ticket JUNIE-3056. CWE-829. CVSS 3.1 is 7.8, local, with user interaction. - The fix JetBrains names is Junie CLI 26.8.3. That GitHub release is build 2548.5, published at 18:06 UTC on 3 August. The note does not cite a CVE. - From 3 August to 15 October is 73 days. The release-channel build published today, 26.10.12, is later, and its note is Figma MCP support. - CISA's 16:05 UTC enrichment says exploitation none, automatable no, technical impact total. JetBrains gives no introduced version, only before 26.8.3. [JetBrains](https://www.jetbrains.com/privacy-security/issues-fixed/) published CVE-2026-111091 at 15:29 UTC on 15 October 2026. The record says code execution was possible in Junie CLI before 26.8.3 via an untrusted project's MCP server configuration. The vendor page names the reporter syaifmax and the ticket JUNIE-3056. The weakness is CWE-829. CVSS 3.1 is 7.8, local, low complexity, no privileges, user interaction required, high confidentiality, integrity, and availability. Hacker News tonight led with Muse Spark Open, a Fortran anniversary, and a study of prompt injection in HTTP headers. US X trends at 22:20 UTC were college football, celebrity, and politics. Muse Spark Open was on that list as a launch. Reuters in this window had no new operator control failure. The [n8n Chat Hub role](/blog/n8n-chat-hub-role-clock) the day before is a separate brief. This one is the Junie project file. High because JetBrains scores code execution from a project the CLI loads, and because the public name arrived 73 days after the release that contains the trust sentence. CISA's enrichment at 16:05 UTC says exploitation none. The path is local and needs a user action. It is not an unauthenticated remote bug. Three panels for Junie CLI: a project MCP configuration could run code, release 26.8.3 shipped on 3 August, and the CVE name arrived on 15 October. ## The configuration traveled with the project. Junie CLI is JetBrains' terminal coding agent. The CVE record, which JetBrains assigned, states that code execution was possible before 26.8.3 through an untrusted project's MCP server configuration. CWE-829 is the inclusion of functionality from a control sphere the program does not trust. The affected range is every release before 26.8.3. JetBrains does not name an introduced build. The score says the path is local and needs one user action. Opening a project you did not write is the shape that matches that vector. This brief does not describe the configuration syntax, the load order, or a payload. JetBrains did not publish those either. > JetBrains says code execution was possible from that configuration. The release that fixed it added a trust check before the CLI loads MCP servers from the project. A file that rides along with a clone is inside the trust decision, not beside it. The same issues list, published 15 October, also names Datalore, TeamCity, and YouTrack flaws. Those products are not this CLI, and their tickets are not JUNIE-3056. ## The package clock is 3 August. GitHub release [26.8.3](https://github.com/JetBrains/junie/releases/tag/2548.5), build 2548.5, published at 18:06 UTC on 3 August 2026. It is not a prerelease. The note's first sentence is: added project trust verification before loading MCP servers, skills, commands, and project configuration. The other sentence is terminal theme detection. Neither sentence names CVE-2026-111091, CWE-829, or syaifmax. The release immediately before it is [26.7.27](https://github.com/JetBrains/junie/releases/tag/2470.4), build 2470.4, published at 16:23 UTC on 28 July. JetBrains marks that release, and every earlier one, as before the fix. The 3 August note is the first release note that states the trust check. This brief did not diff the binary. The disclosure clock is the CVE timestamp, 15:29 UTC on 15 October, 73 days after 3 August. The issues page uses the same publication date, 15 October. CISA added SSVC at 16:05 UTC: exploitation none, automatable no, technical impact total. The release channel's current build is not 26.8.3. [26.10.12](https://github.com/JetBrains/junie/releases/tag/3659.6), build 3659.6, published at 14:52 UTC today, about 37 minutes before the CVE. Its note is Figma MCP support. It is a later build than 2548.5. It is not the note that added the trust sentence. The [version list](https://github.com/jetbrains-junie/junie/blob/main/update-info.jsonl) the release-channel installer reads ends at 3659.6 tonight. Nightly tags on the release repository use higher build numbers and are not that list. > Installing today's channel build gets you a version after 26.8.3. It does not make 15 October the day the control shipped. The trust sentence is on the 3 August tag. The CVE is the public name. ## What to do if the CLI is still below 26.8.3. Compare the version you run with 26.8.3, build 2548.5. If it is that release or a later one, JetBrains already names you past the affected range. The work left is to know that the public record is new, not the package. If the CLI is older, move to the current release channel. Tonight that build is 26.10.12. Until an older CLI is updated, do not point it at a repository you do not trust. The configuration JetBrains describes is the project's, not a setting that lives only in your home directory. Read the MCP server configuration a cloned project ships before you let the agent act on it. That is a review of what you are about to load. It is not a procedure for triggering the bug, and this brief will not add one. The 3 August note also covers skills, commands, and project configuration, which the CVE sentence does not. Treat the CVE as the MCP claim JetBrains published, and the release note as the broader trust check they shipped. Do not file Figma support on 26.10.12 as the remediation note. CISA says exploitation none. That is not a reason to leave a CLI below 26.8.3 on a laptop that opens other people's trees. The impact window for anyone who took 26.8.3 in August closed on 3 August. The impact window for a pinned older build is still open, and the disclosure clock started today. ## Sources - [Fixed security issues](https://www.jetbrains.com/privacy-security/issues-fixed/) (2026-10-15) - [CVE-2026-111091](https://www.cve.org/CVERecord?id=CVE-2026-111091) (2026-10-15) - [Junie Release 26.8.3 (2548.5)](https://github.com/JetBrains/junie/releases/tag/2548.5) (2026-08-03) - [Junie Release 26.10.12 (3659.6)](https://github.com/JetBrains/junie/releases/tag/3659.6) (2026-10-15) - [Junie CLI release-channel version list](https://github.com/jetbrains-junie/junie/blob/main/update-info.jsonl)