CVE-2026-49384
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In JetBrains PyCharm before version 2025.3.4, a stored XSS vulnerability was found in Jupyter notebook Markdown cells. An attacker can inject malicious JavaScript that executes in the browser of any user viewing the notebook.
Risk Assessment
Risk of session theft, data exfiltration, or unauthorized actions performed in the victim's context.
Recommendation
Upgrade PyCharm to version 2025.3.4 or later.
Other vulnerabilities in JetBrains PyCharm
See all- CVE-2026-75060High
In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools.
- CVE-2026-75059Medium
In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible.
- CVE-2026-65908High
In JetBrains PyCharm before versions 2026.1.4 and 2026.2, arbitrary code execution was possible via a malicious Python executable when opening an untrusted project.
Original NVD description (English source)
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible