CVE-2021-30005

CVE-2021-30005 affects JetBrains PyCharm prior to 2020.3.4. The issue stems from PyCharm's initial project handling where, on first open, PyCharm would auto-activate a virtual environment found in the project, enabling an attacker to place a malicious venv in a VCS repository. A PoC demonstrates ...

CVE-2024-37051

CVE-2024-37051 describes insufficient protection of GitHub access tokens in multiple JetBrains IDEs, allowing potential exposure of tokens to third-party sites. Affected products/versions include IntelliJ IDEA, Aqua, CLion, DataGrip, DataSpell, GoLand, MPS, PhpStorm, PyCharm, Rider, RubyMine, Rus...

CVE-2019-14958

CVE-2019-14958 affects JetBrains PyCharm prior to 2019.2. The issue is described as a vulnerability where a buffer of unknown size was allocated for a connection process, which in a specific scenario could cause a remote invocation of an out‑of‑memory (OOM) error message due to uncontrolled memor...

CVE-2026-49384

JetBrains PyCharm before 2025.3.4 is affected by a stored XSS vulnerability in Jupyter notebook Markdown cells. The CVE notes untrusted content in Markdown cells can be rendered, enabling potential script execution. Supported data: CVSS 3.1 base score 6.1 (Network attack vector, required user int...

CVE-2026-25847

Affected software/issue: JetBrains PyCharm (pre-2025.3.2) has a DOM-based XSS in the Jupyter viewer page. Consequence: High-severity impact (CVSS 3.1: 8.2) with confidentiality and integrity impacted; exploitation requires user interaction and is network-vector, per the entry. Root cause/vector: ...

CVE-2022-29821

JetBrains Rider affected: local code execution vulnerability in versions prior to 2022.1 caused by crafted links in ReSharper Quick Documentation. Root cause details are not provided beyond the affect scope in the connected documents. There is no explicit exploit status or remediation information...

CVE-2022-29820

JetBrains PyCharm before 2022.1 has a vulnerability where the debugger port could be exposed to the internal network. The connected documents confirm the affected product and issue description but do not provide explicit root-cause details, exploit information, impact beyond low severity, or a pa...

CVE-2026-75060

JetBrains PyCharm versions prior to 2026.2.1 are vulnerable to unauthenticated remote code execution through Jupyter MCP (Model Context Protocol) tools. MCP is a standard that allows AI models to access data and tools from external sources; in this case, the Jupyter MCP tools in PyCharm could be ...

CVE-2026-75059

In JetBrains PyCharm before 2026.2.1, the Quick Documentation feature allows local code execution with no privileges required. Attack requires user interaction, rated CVSS 4.4 (MEDIUM). Fix: upgrade to 2026.2.1. No in-the-wild exploitation reported. Reference: https://www.jetbrains.com/privacy-se...

CVE-2026-65908

JetBrains PyCharm is affected by CVE-2026-65908. In PyCharm before 2026.1.4 (and 2026.2), an attacker could achieve arbitrary code execution by opening a malicious Python executable in an untrusted project. Root cause is likely processing of Python executables on project open; CVSSv3.1 indicates ...