---
title: JetBrains Junie CLI CVE-2026-111091: an untrusted project's MCP server config could run code | ctxsec
url: https://ctxsec.com/items/junie-cli-cve-2026-111091
description: ""
status: "confirmed (vendor CNA); no known exploitation"
published: 2026-10-15
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/junie-cli-cve-2026-111091.md)

confirmed (vendor CNA); no known exploitation

2026-10-15

### JetBrains Junie CLI CVE-2026-111091: an untrusted project's MCP server config could run code

JetBrains published CVE-2026-111091 on Oct 15. In Junie CLI before 26.8.3, a project's MCP server configuration could run code even when the project was untrusted (CVSS 3.1 7.8, local, user interaction required, CWE-829). Junie keeps project MCP servers in `.junie/mcp/mcp.json`, a file teams can commit to their repos, so opening a booby-trapped repo was enough. Current docs say untrusted projects no longer load project MCP servers, hooks, skills or guidelines. The fix (26.8.3) shipped in August. This is the same class of bug as the earlier IDE and agent "open the repo, run the server" flaws. Update the CLI, and use `--mcp-default-locations false` when you review unfamiliar code.

Sources: [CVE-2026-111091 (CVE.org, JetBrains CNA)](https://www.cve.org/CVERecord?id=CVE-2026-111091) · [JetBrains fixed security issues](https://www.jetbrains.com/privacy-security/issues-fixed/) · [Junie docs: MCP configuration](https://junie.jetbrains.com/docs/junie-cli-mcp-configuration.html)