High · 7.5 CVE-2026-123855 EUVD-2026-118315GHSA-7r7r-mmv3-x6mw

In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs

Published Nov 6, 2026 · Updated Nov 7, 2026 · Assigned by JetBrains

Vendor: JetBrains Product: Toolbox App

Description

In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs

Affected products

Vendor	Product	Affected	Fixed
JetBrains	Toolbox App	< 3.6.1	3.6.1

Advisories 1

WID-SEC-2026-4393 JetBrains Toolbox App: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026

References

https://www.jetbrains.com/privacy-security/issues-fixed/