CVE-2026-65908
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In JetBrains PyCharm before versions 2026.1.4 and 2026.2, arbitrary code execution was possible via a malicious Python executable when opening an untrusted project.
Risk Assessment
An attacker can supply a malicious project that, when opened in PyCharm, executes arbitrary code, potentially leading to system compromise or data theft.
Recommendation
Upgrade PyCharm to version 2026.1.4 or later (or 2026.2 with the fix).
Other vulnerabilities in JetBrains PyCharm
See all- CVE-2026-75060High
In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools.
- CVE-2026-75059Medium
In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible.
- CVE-2026-49384Medium
In JetBrains PyCharm before version 2025.3.4, a stored XSS vulnerability was found in Jupyter notebook Markdown cells. An attacker can inject malicious JavaScript that executes in the browser of any user viewing the notebook.
Original NVD description (English source)
In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open