---
title: JetBrains Junie CLI before 26.8.24: the "Allow Similar Commands" option let commands run that the user never approved (CVE-2026-123315) | ctxsec
url: https://ctxsec.com/items/junie-cli-cve-2026-123315-allow-similar-commands-execution-26-8-24
description: "JetBrains' CVE says command execution was possible through Junie CLI's Allow Similar Commands option before version 26.8.24, rated CVSS 3.1 7.0 (local, high complexity, user interaction). A loose \"similar command\" match is effectively a pattern between the coding agent and your shell, so an injected or unexpected command can slip through an approval meant for something else."
status: "official CVE record (JetBrains as CNA; GitHub Advisory GHSA-3cv3-8rwm-vvm3, Nov 6)"
published: 2026-11-09
---

> JetBrains' CVE says command execution was possible through Junie CLI's Allow Similar Commands option before version 26.8.24, rated CVSS 3.1 7.0 (local, high complexity, user interaction). A loose "similar command" match is effectively a pattern between the coding agent and your shell, so an injected or unexpected command can slip through an approval meant for something else.

[← Context & Harness Attacks](/context) · [markdown](/items/junie-cli-cve-2026-123315-allow-similar-commands-execution-26-8-24.md)

official CVE record (JetBrains as CNA; GitHub Advisory GHSA-3cv3-8rwm-vvm3, Nov 6)

2026-11-09

### JetBrains Junie CLI before 26.8.24: the "Allow Similar Commands" option let commands run that the user never approved (CVE-2026-123315)

- Update Junie CLI to 26.8.24 or later.
- Prefer exact-command approvals for agents, and avoid broad "allow similar" rules on shells that hold credentials.

Sources: [GitHub Advisory: GHSA-3cv3-8rwm-vvm3](https://github.com/advisories/GHSA-3cv3-8rwm-vvm3) · [NVD: CVE-2026-123315](https://nvd.nist.gov/vuln/detail/CVE-2026-123315) · [JetBrains: Fixed security issues](https://www.jetbrains.com/privacy-security/issues-fixed)