cve-2026-123854
MEDIUM CVSS 5.5 unknown
Description
In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module
Timeline
- Published
- 2026-11-06 16:10 UTC
- Last Modified
- 2026-11-07
CVSS Details
- Attack Vector
- LOCAL
- Attack Complexity
- LOW
- Privileges Required
- NONE
Affected Products
- JetBrains PyCharm
Weaknesses (CWE)
SSVC (CISA Stakeholder-Specific Vulnerability Categorization)
CISA Coordinator
v2.0.3
- Exploitation
none- Automatable
no- Technical Impact
total- Decision timestamp
2026-11-06T00:00:00+00:00
What is SSVC? — CISA's vulnerability-prioritisation framework using a decision tree rather than a single score.
Linked Vulnerabilities
No linked vulnerabilities found.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-123854",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-07T04:55:46.206Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PyCharm",
"vendor": "JetBrains",
"versions": [
{
"lessThan": "2026.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T16:10:11.837Z",
"orgId": "547ada31-17d8-4964-bc5f-1b8238ba8014",
"shortName": "JetBrains"
},
"references": [
{
"url": "https://www.jetbrains.com/privacy-security/issues-fixed/"
}
],
"x_gcve": [
{
"recordType": "advisory",
"vulnId": "CVE-2026-123854"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "547ada31-17d8-4964-bc5f-1b8238ba8014",
"assignerShortName": "JetBrains",
"cveId": "CVE-2026-123854",
"datePublished": "2026-11-06T16:10:11.837Z",
"dateReserved": "2026-11-06T16:05:47.709Z",
"dateUpdated": "2026-11-07T04:55:46.206Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-123854\",\"sourceIdentifier\":\"cve@jetbrains.com\",\"published\":\"2026-11-06T17:17:24.577\",\"lastModified\":\"2026-11-06T20:20:05.730\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module\"}],\"affected\":[{\"source\":\"cve@jetbrains.com\",\"affectedData\":[{\"vendor\":\"JetBrains\",\"product\":\"PyCharm\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"2026.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve@jetbrains.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-11-06T16:42:06.986892Z\",\"id\":\"CVE-2026-123854\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cve@jetbrains.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-829\"}]}],\"references\":[{\"url\":\"https://www.jetbrains.com/privacy-security/issues-fixed/\",\"source\":\"cve@jetbrains.com\"}]}}"
},
"x_gcve": [
{
"extensions": {
"bcp-05-x-01": {
"ai_annotations": [
{
"ai_level": "generated",
"description": "VLAI severity classification was generated by Vulnerability-Lookup's /vlai/severity-classification API endpoint based on vulnerability description text.",
"field_name": "x_gcve.extensions.vlai-severity-enrichment",
"models": [
{
"gna_source": 1,
"identifier": "vlai-severity-classification",
"name": "VLAI Severity",
"provider": "CIRCL",
"version": "fc530b2263ef5a89ae4c75ffcbf6b4d878d44b94"
}
],
"review_status": "none",
"scope": "field",
"tags": [
"ai-computer-assisted:assistance-level=\"ai-generated\"",
"ai-computer-assisted:review-level=\"unreviewed\""
]
}
]
},
"vlai-severity-enrichment": {
"confidence": 0.6112834811210632,
"generated_at": "2026-11-07T05:27:39+00:00",
"severity": "High",
"vulnerability_id": "CVE-2026-123854"
}
}
}
]
}
Enrichment data
Aggregated bundle (all enrichments)