What happened
JetBrains published CVE-2026-111091 on 2026-10-15 (CVSS 7.8, CWE-829; verified via NVD REST — version < 26.8.3 affected). The Junie CLI, JetBrains' AI coding agent, allowed code execution via an untrusted project's MCP server configuration: a project-level MCP config authored by an attacker is trusted and executed when the agent connects, enabling arbitrary code on the developer's machine. CISA SSVC assessed total technical impact.
Why it matters
Project-committed MCP config is the AI-era analog of repo-committed .npmrc/.vscode settings — the supply chain ships trust boundaries inside the repository. For an AI coding agent like Junie that acts with the developer's permissions, a poisoned .junie/mcp config in a cloned repo is a silent code-execution-on-open primitive against every developer who pulls the repo, exposing source code, credentials and CI access.
Attack vector
Opening an untrusted repository whose MCP server configuration points Junie at a malicious or attacker-controlled MCP server definition leads to code execution on the developer machine when Junie loads/connects the configured server — an agent-config trust failure (CWE-829, inclusion of unsafe functions from untrusted control realm).
Affected systems
JetBrains Junie CLI < 26.8.3
Mitigation
Upgrade Junie CLI to 26.8.3 or later (see JetBrains issues-fixed page). Until patched, audit every MCP server config in repositories you open; never run Junie on trusted infrastructure or with elevated privileges against untrusted repos; keep MCP server definitions out of untrusted projects.