al-ice.ai

The Guardrail Decoded Its Way Around Itself: JetBrains Junie’s Prompt-Injection Bypass, Fork-Update RCE, and Two CLI Flaws

AI Vulnerabilities & CVEs by al-ice.ai Editorial

Four CVE records for JetBrains Junie — the company’s AI coding agent — reached NVD on 6 November 2026, and they cut across both halves of the product: the Junie GitHub Action and the Junie CLI. The Action pair is the one to read first: CVE-2026-123851 (CVSS 5.4) records that the Action’s prompt-injection protection could be bypassed with HTML-encoded characters (fixed in 1.6.4, reported by Jean-François Baudson “redlemonbe”), and CVE-2026-123852 (CVSS 7.4) records that code execution with workflow credentials was possible via fork updates (fixed in 1.8.0, reported by Antoni Tremblay). The CLI pair is quieter but closer to developers’ secrets: CVE-2026-123315 (CVSS 7.0) — command execution through the Allow Similar Commands option’s permissive matching (fixed in 26.8.24), and CVE-2026-123316 — sensitive environment variables exposed in session event logs (fixed in 26.6.29). All four are confirmed on JetBrains’ own fixed-issues page, which rates both CLI flaws High even where NVD scoring lands lower — a split worth taking seriously, as we’ll see.

The Action pair: a guardrail that decodes, and credentials that inherit

CVE-2026-123851 (CWE-180, JUNIE-3424) is the most on-theme flaw in the batch: the failure is not in the agent but in the protection wrapped around it. A GitHub Action that runs a coding agent necessarily feeds untrusted text — issue bodies, PR comments, diffs — into the model, and Junie ships a prompt-injection protection layer for exactly that boundary. HTML-encoded characters bypassed it: the filter inspected a benign-looking surface while the payload survived underneath to be decoded downstream. That is the classic guardrail-decoder gap, and in an agent runner it converts directly into an indirect-prompt-injection path: whoever can get encoded text into content the agent reads gets to talk past the bouncer. CVE-2026-123852 (CWE-863, JUNIE-5036) is the higher-severity sibling and the more familiar shape: runs triggered by fork updates could execute code carrying the workflow’s credentials. Any maintainer who has hardened pull_request_target workflows knows this geometry — attacker-influenced events meeting ambient authority — except here the executor is an autonomous agent with repository credentials rather than a shell script. The CVSS vector’s honesty is worth noting (AV:N/AC:H/PR:N/UI:N: network-reachable, but gated on the high-complexity fork-update precondition), and the fix version tells its own story — 1.8.0 versus 1.6.4 for the bypass, meaning the two Action flaws shipped in different releases and both need confirming, not just “latest.”

The CLI pair: fuzzy approval and chatty logs

CVE-2026-123315 (CWE-625, JUNIE-3161) targets a convenience feature with a sharp edge: Allow Similar Commands lets the CLI run commands resembling ones the user already approved, and the similarity check was a permissive regular expression. Fuzzy approval is a trust decision wearing a UX costume — approve npm run build and a near-neighbor string with very different semantics can ride the same approval through. Local access plus user interaction keeps the score at 7.0, which is fair for a single-developer workstation and beside the point on a shared build host or a paired session. CVE-2026-123316 (CWE-532, JUNIE-2781) is the sleeper: session event logs captured sensitive environment variables, so API keys and tokens sitting in the shell environment ended up persisted wherever session logs go — support bundles, synced machines, shared workstations. Note the scoring split and resolve it in favor of caution: NVD’s 5.5 (AV:L/AC:L/PR:L) treats this as a low-privilege local read, while JetBrains rates it High. For secrets exposure, the vendor’s rating is the better planning number — log exfiltration is hard to scope after the fact, and “who could read the log” is a question most teams answer wrong.

What to actually do

  1. Upgrade to Junie GitHub Action 1.8.0+ and Junie CLI 26.8.24+. The CLI target is single-valued — 26.8.24 postdates both CLI fixes (26.6.29 for the log exposure, 26.8.24 for the command matching) — but the Action needs both halves confirmed: 1.6.4 for the injection bypass and 1.8.0 for the fork-update flaw. Pin Action versions by SHA while you’re there.
  2. Treat agent runs on fork-triggered events as untrusted code execution — gate them behind explicit maintainer approval before the agent (and the workflow credentials) ever sees the content. The same review discipline applies to the injection bypass: assume encoded and obfuscated text reaches the model, and scope the workflow token to the minimum the agent genuinely needs. Our October Junie CLI coverage showed the same product tripping on untrusted-project trust boundaries from the other direction.
  3. Rotate secrets that may have touched session logs on pre-26.6.29 CLI installs — LLM API keys, cloud credentials, tokens present in the environment during agent sessions — and check where session event logs are stored, synced, or uploaded in your setup. Then turn the same flashlight on the “similar commands” class everywhere: any fuzzy-approval feature in an agent tool is a regex away from this bug.
  4. For builders: normalize before you filter, and log after you redact. Inspect the decoded form at every layer that will decode it, not the encoded form the attacker chose; and treat environment capture in telemetry as secrets handling, with redaction at write time rather than access control at read time. JetBrains’ own batch — spanning the October TeamCity fix batch through this one — keeps teaching the same lesson: developer tools inherit every trust boundary they automate.

Our verification was read-only. We read all four NVD 2.0 API records first-hand (CVE-2026-123851 published 6 November 2026 ~17:17 UTC, CVSS 3.1 5.4 AV:N/AC:L/PR:N/UI:R, CWE-180; CVE-2026-123852 published ~17:17 UTC, CVSS 3.1 7.4 AV:N/AC:H/PR:N/UI:N, CWE-863; CVE-2026-123315 published ~11:17 UTC, CVSS 3.1 7.0 AV:L/AC:H/PR:N/UI:R, CWE-625; CVE-2026-123316 published ~11:17 UTC, CVSS 3.1 5.5 AV:L/AC:L/PR:L/UI:N, CWE-532 — all four in Awaiting Analysis state at read time, with JetBrains as assigning CNA and jetbrains.com as the reference), and JetBrains’ fixed-security-issues page first-hand via a rendered read (Junie CLI Allow Similar Commands High / 26.8.24 / JUNIE-3161; Junie CLI session-log env exposure High / 26.6.29 / JUNIE-2781; Junie GitHub Action fork-update code execution High / 1.8.0 / JUNIE-5036 reported by Antoni Tremblay; Junie GitHub Action injection-protection bypass Medium / 1.6.4 / JUNIE-3424 reported by redlemonbe — including the JetBrains-High versus NVD-Medium split on CVE-2026-123316, stated openly here). We ran no agent, crafted no encoded payload, opened no fork PR, inspected no session log, and contacted no vendor. Brave Search was used for discovery only.

Sources: