cnvd - cnvd-2025-22317

CNVD-2025-22317

Vulnerability from cnvd - Published: 2025-09-22

Title

JetBrains Junie命令注入漏洞

Description

JetBrains Junie是捷克JetBrains公司的一个编码代理。 JetBrains Junie存在命令注入漏洞，该漏洞源于命令验证不当，攻击者可利用该漏洞导致代码执行。

Severity

高

Patch Name

JetBrains Junie命令注入漏洞的补丁

Patch Description

JetBrains Junie是捷克JetBrains公司的一个编码代理。 JetBrains Junie存在命令注入漏洞，该漏洞源于命令验证不当，攻击者可利用该漏洞导致代码执行。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.jetbrains.com/privacy-security/issues-fixed/

Reference

https://nvd.nist.gov/vuln/detail/CVE-2025-59458

Impacted products

Name
['JetBrains Junie <252.284.66', 'JetBrains Junie 251.284.66', 'JetBrains Junie 243.284.66', 'JetBrains Junie 252.284.61', 'JetBrains Junie 251.284.61', 'JetBrains Junie 243.284.61', 'JetBrains Junie 252.284.50', 'JetBrains Junie 252.284.54', 'JetBrains Junie 251.284.54', 'JetBrains Junie 251.284.50', 'JetBrains Junie 243.284.54', 'JetBrains Junie 243.284.50']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2025-59458",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2025-59458"
    }
  },
  "description": "JetBrains Junie\u662f\u6377\u514bJetBrains\u516c\u53f8\u7684\u4e00\u4e2a\u7f16\u7801\u4ee3\u7406\u3002\n\nJetBrains Junie\u5b58\u5728\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u547d\u4ee4\u9a8c\u8bc1\u4e0d\u5f53\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u4ee3\u7801\u6267\u884c\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.jetbrains.com/privacy-security/issues-fixed/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-22317",
  "openTime": "2025-09-22",
  "patchDescription": "JetBrains Junie\u662f\u6377\u514bJetBrains\u516c\u53f8\u7684\u4e00\u4e2a\u7f16\u7801\u4ee3\u7406\u3002\r\n\r\nJetBrains Junie\u5b58\u5728\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u547d\u4ee4\u9a8c\u8bc1\u4e0d\u5f53\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u4ee3\u7801\u6267\u884c\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "JetBrains Junie\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "JetBrains Junie \u003c252.284.66",
      "JetBrains Junie 251.284.66",
      "JetBrains Junie 243.284.66",
      "JetBrains Junie 252.284.61",
      "JetBrains Junie 251.284.61",
      "JetBrains Junie 243.284.61",
      "JetBrains Junie 252.284.50",
      "JetBrains Junie 252.284.54",
      "JetBrains Junie 251.284.54",
      "JetBrains Junie 251.284.50",
      "JetBrains Junie 243.284.54",
      "JetBrains Junie 243.284.50"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2025-59458",
  "serverity": "\u9ad8",
  "submitTime": "2025-09-19",
  "title": "JetBrains Junie\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2025-59458 (GCVE-0-2025-59458)

Vulnerability from cvelistv5 – Published: 2025-09-17 09:04 – Updated: 2025-09-17 13:02

Summary

In JetBrains Junie before 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 code execution was possible due to improper command validation

Severity ?

8.3 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE

CWE-77

Assigner

JetBrains

References

URL

Tags

https://www.jetbrains.com/privacy-security/issues…

Impacted products

	Vendor	Product	Version
	JetBrains	Junie	Affected: 0 , < 252.284.66, 251.284.66, 243.284.66, 252.284.61, 251.284.61, 243.284.61, 252.284.50, 252.284.54, 251.284.54, 251.284.50, 243.284.54, 243.284.50 (semver)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-59458",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-17T13:02:21.563782Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-17T13:02:29.686Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Junie",
          "vendor": "JetBrains",
          "versions": [
            {
              "lessThan": "252.284.66,\n251.284.66,\n243.284.66,\n252.284.61,\n251.284.61,\n243.284.61,\n252.284.50,\n252.284.54,\n251.284.54,\n251.284.50,\n243.284.54,\n243.284.50",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In JetBrains Junie before 252.284.66,\n251.284.66,\n243.284.66,\n252.284.61,\n251.284.61,\n243.284.61,\n252.284.50,\n252.284.54,\n251.284.54,\n251.284.50,\n243.284.54,\n243.284.50 code execution was possible due to improper command validation"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-17T09:04:03.342Z",
        "orgId": "547ada31-17d8-4964-bc5f-1b8238ba8014",
        "shortName": "JetBrains"
      },
      "references": [
        {
          "url": "https://www.jetbrains.com/privacy-security/issues-fixed/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "547ada31-17d8-4964-bc5f-1b8238ba8014",
    "assignerShortName": "JetBrains",
    "cveId": "CVE-2025-59458",
    "datePublished": "2025-09-17T09:04:03.342Z",
    "dateReserved": "2025-09-16T13:21:51.694Z",
    "dateUpdated": "2025-09-17T13:02:29.686Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2025-22317

CVE-2025-59458 (GCVE-0-2025-59458)

Tags

Sightings

Nomenclature