Description

In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T11:17:06.390Z",
  "pubdate": "2026-11-06T11:17:06.390Z",
  "executiveSummary": "A command injection vulnerability exists within JetBrains Datalore versions prior to 2026.4, specifically involving the interaction between notebook code and the sidecar container environment.\nThe vulnerability originates from insufficient validation or sanitization when the notebook code interfaces with the mount broker service.\nSuccessful exploitation allows an attacker to execute arbitrary commands within the context of the sidecar container.\nThis flaw poses a significant security risk, as it permits unauthorized code execution, potential lateral movement within the containerized infrastructure, and access to sensitive data or configuration files mounted within the environment.\nThe vulnerability impacts users of Datalore in configurations where notebook code can interact with the sidecar orchestration layer.\nExploitation requires the ability to execute notebook code within a Datalore instance.\nThe primary risk implication is the compromise of container isolation, potentially leading to unauthorized data exfiltration or persistence within the container orchestration platform.",
  "technicalDetails": "The vulnerability is situated within the architecture that facilitates communication between the Datalore notebook environment and the sidecar container, specifically mediated by the mount broker.\nIn affected versions of JetBrains Datalore, the mount broker fails to properly restrict or sanitize requests originating from the notebook runtime.\nThe root cause is an improper trust boundary between the notebook execution environment and the sidecar container management functions.\nWhen a user executes code within a notebook, the application architecture allows for the transmission of commands intended to interact with the mount broker for file system operations.\nBecause the mount broker does not sufficiently validate the input or enforce strict operational parameters, an attacker can craft malicious input that includes command injection sequences.\nThe attack flow begins when an attacker, possessing access to a notebook environment, submits a specifically crafted payload through the interface responsible for communicating with the mount broker.\nThe mount broker processes this payload, failing to sanitize the embedded commands, and subsequently executes the payload within the context of the sidecar container.\nThis elevated context allows the attacker to execute arbitrary system commands, bypass intended security boundaries, and interact with the file system or environment variables of the sidecar.\nThe exploitation does not necessarily require additional authentication beyond the ability to run notebook code, though the scope of the impact is defined by the privileges of the service account running the sidecar container.\nPost-exploitation, an attacker could potentially gain unauthorized access to data, interfere with other processes running in the sidecar, or leverage the compromised container to perform further network reconnaissance or lateral movement within the Datalore infrastructure."
}