Description

In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-11-06T11:17:05.740Z",
  "pubdate": "2026-11-06T11:17:05.740Z",
  "executiveSummary": "A critical security vulnerability exists in JetBrains CLion involving the improper handling of GDB server debug profiles while the application is operating in Safe Mode.\nThis vulnerability allows an authenticated attacker to achieve arbitrary code execution on the host machine by supplying a maliciously crafted debug configuration.\nThe flaw affects versions of CLion prior to 2026.3 and 2026.2.4.1.\nThe primary risk is a total compromise of the developer environment, as successful exploitation bypasses the security restrictions intended by Safe Mode, allowing for the execution of arbitrary commands with the privileges of the CLion process.\nExploitation requires the attacker to influence the debug profile configuration, posing a threat to users who import untrusted project configurations or debug profiles from potentially compromised repositories.",
  "technicalDetails": "The vulnerability resides in the interaction between CLion's debugging infrastructure and the parsing of external debug profile configurations. In scenarios where CLion is configured to operate in Safe Mode—which is designed to restrict potentially unsafe IDE operations—the application fails to adequately sanitize or validate inputs provided within a GDB server debug profile.\nWhen a user imports or selects a crafted GDB server profile, the IDE processes parameters designed to initiate the debugger's connection to a remote or local GDB instance. The root cause lies in an insecure command-line construction or process invocation mechanism where user-supplied strings from the debug profile are passed to the underlying operating system's shell or execution API without sufficient escaping or validation.\nThe attack flow proceeds as follows: First, an attacker constructs a malicious debug profile that embeds arbitrary commands within the GDB configuration fields (such as 'GDB command file' or specific execution arguments). Second, the attacker entices a victim to load this profile into their CLion instance. Third, upon initiating the debugging session using the poisoned profile, CLion invokes the GDB server debugger, inadvertently triggering the execution of the attacker's embedded payload.\nBecause the payload is executed within the context of the CLion process, the attacker inherits the user's local privileges. Even though the application claims to be in Safe Mode, the logic responsible for the debugger integration fails to honor the restrictions imposed on other parts of the IDE, effectively neutralizing the safety boundary. This allows for persistent code execution, potential data exfiltration from the project directory, or the deployment of secondary malware.\nThe affected versions include all releases prior to 2026.3 and specifically those prior to 2026.2.4.1. The vulnerability does not require remote network connectivity, but rather relies on the local processing of the malicious configuration file. No specific authentication is required if the attacker can place the malicious configuration where the user will import it, making this a significant supply-chain risk for development environments."
}