Description

In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-11-06T17:17:21.387Z",
  "pubdate": "2026-11-06T17:17:21.387Z",
  "executiveSummary": "A critical security vulnerability exists in JetBrains CLion before version 2026.2, enabling arbitrary code execution while the application operates in Safe Mode. This vulnerability stems from improper validation of JSON compilation database files, which are used to configure project build settings. An attacker capable of providing a maliciously crafted compilation database can bypass security restrictions intended to prevent untrusted code execution during project loading. The vulnerability poses a significant risk as it allows unauthorized execution of arbitrary commands with the privileges of the CLion process. Exploitation requires the victim to open a maliciously prepared project containing the crafted JSON configuration. Successful exploitation could lead to full system compromise, sensitive data exfiltration, or lateral movement within the development environment, depending on the current user permissions. This flaw underscores the risks associated with processing externally sourced configuration files in complex development environments.",
  "technicalDetails": "The vulnerability resides in the way JetBrains CLion parses and processes JSON compilation database files (compile_commands.json). Although CLion implements a 'Safe Mode' feature designed to restrict dangerous operations when opening projects from untrusted sources, the validation logic applied to compilation databases is insufficient. When a project is loaded, CLion attempts to configure the build environment by interpreting the entries within the JSON compilation database. The root cause is an improper sanitization and validation mechanism for fields within this database that are subsequently passed to system-level interpreters or build tools.\nDuring the attack flow, a malicious actor provides a target with a project directory containing a specifically crafted 'compile_commands.json' file. When the victim opens this directory in CLion, the IDE parses the JSON entries. The flaw allows an attacker to inject arbitrary commands into fields that the IDE incorrectly treats as trusted or safe for execution. Because the IDE utilizes these fields to invoke external build-related executables or shell commands to facilitate indexing and environment configuration, the attacker's payload is executed by the IDE process.\nThe exploitation does not require the user to actively build the project; the execution occurs during the automatic project synchronization or indexing phase initiated upon opening the project in Safe Mode. Consequently, the IDE processes the malicious instructions under the security context of the logged-in user. The vulnerability circumvents the intended security boundaries of Safe Mode, which are designed to suppress scripts and task execution that could typically lead to code execution.\nPost-exploitation, an attacker can achieve persistent code execution on the host machine. The capabilities are commensurate with the permissions of the IDE process, allowing the attacker to read, modify, or delete project files, environment variables, or potentially escalate privileges if local vulnerabilities exist. By weaponizing the compilation database, attackers can turn a legitimate IDE utility—intended to assist in complex C/C++ project management—into a vector for remote code execution.\nAffected versions include all CLion iterations prior to 2026.2. There are no specific authentication or network exposure requirements beyond the ability to deliver the malicious project file to the victim, commonly achieved via social engineering or cloned repositories."
}