JetBrains PyCharm vulnerabilities

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools.

In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible.

In JetBrains PyCharm before versions 2026.1.4 and 2026.2, arbitrary code execution was possible via a malicious Python executable when opening an untrusted project.

In JetBrains PyCharm before version 2025.3.4, a stored XSS vulnerability was found in Jupyter notebook Markdown cells. An attacker can inject malicious JavaScript that executes in the browser of any user viewing the notebook.