Glossary term
Patch management
Patch management is the process of identifying, prioritizing, acquiring, installing, and verifying patches, updates, and upgrades across an organization.
Read more
Vulnerability
JetBrains CLion Safe Mode Code Execution via Meson Settings (CVE-2026-123831)
A flaw in JetBrains CLion where opening a project in Safe Mode still allowed code execution through the project's Meson build settings.
- CVE ID
- CVE-2026-123831
- CVSS
- 9.6 Critical (CVSS v3.1, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, CNA cve@jetbrains.com); no CVSS 4.0 score in the record or NVD
- Affected product
- CLion, before 2026.2 and before 2026.1.4
- Exploited
- Unknown
- Published
- 6 November 2026 (CVE record and NVD)
In short
CVE-2026-123831 is a flaw in JetBrains CLion where opening a project in Safe Mode still allowed code execution through the project's Meson build settings. JetBrains' own fixed-issues page rates it Critical and resolved the flaw in CLion 2026.2 and 2026.1.4. NVD and the CVE record, assigned by JetBrains as the CNA, score it CVSS 3.1 9.6 Critical; no CVSS 4.0 score is in the record or NVD.
- CVECVE-2026-123831
- ProductJetBrains CLion, before 2026.2 and before 2026.1.4
- Fix Steps4actions listedReview Trusted Locations
What it allows
CVE-2026-123831 sits in how CLion handles a project it has not been told to trust. JetBrains' own help documentation says CLion runs a project's build scripts while loading it. For a CMake, Makefile or Gradle project, the IDE first shows a Trust dialog with a Safe Mode option. Safe Mode lets a developer browse an unfamiliar project's source without running its build, scripts or startup tasks.
JetBrains' fixed-issues page lists this flaw as code execution that was possible in Safe Mode through a project's Meson settings, tracked internally as CPP-50364. The CVE record gives no further technical detail beyond that one line, the CWE class and the severity rating.
How CVE-2026-123831 Scores
JetBrains, the CNA, scores it CVSS 3.1 9.6 Critical with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. The UI:R component means the record treats this as needing some user interaction, which fits a developer opening a project in their IDE. There is no CVSS 4.0 score in the record or NVD.
What Safe Mode Normally Blocks
JetBrains' help page says a project opened in Safe Mode has startup tasks disabled, version control support fully disabled, file watcher scripts that do not run, and database connections disabled. The page describes this for CMake, Makefile and Gradle projects by name; it does not name Meson specifically, though CLion also opens Meson projects through the same Trust dialog.
What JetBrains and CISA KEV Say
JetBrains' fixed-issues page lists this entry with no mention of active exploitation. As of CISA catalogue version 2026.11.06, CVE-2026-123831 is not in the Known Exploited Vulnerabilities catalogue.
Who is affected
JetBrains' fixed-issues page lists the flaw as resolved in CLion 2026.2 and 2026.1.4. JetBrains tracks the fix internally as CPP-50364.
The CVE record lists no other JetBrains product as affected by CVE-2026-123831.
Timeline
- 6 Nov 2026
JetBrains publishes the CVE record for CVE-2026-123831 and NVD publishes its entry, both naming the fix in CLion 2026.2 and 2026.1.4.
- 4 Nov 2026
JetBrains' Project security help page, which documents the general Safe Mode mechanism this flaw bypasses, shows a last-modified date of 4 November 2026.
What to do
-
Update CLion to 2026.2 or 2026.1.4
Move every CLion installation to 2026.2, or to 2026.1.4 if your team stays on the 2026.1 line, per JetBrains' fixed-issues page, as part of regular patch prioritization.
-
Treat Unfamiliar Projects as Untrusted
We recommend opening a project from an unknown source in Safe Mode first, and only trusting it after a manual review of its build configuration, including any Meson settings.
-
Review Trusted Locations
JetBrains' help page says a directory added to Trusted Locations loads automatically without a prompt. We recommend checking that list for folders that no longer need automatic trust.
-
Check Headless and Scripted Launches
JetBrains' help page warns that a command-line, headless launch of CLion opens a project in trusted mode by default. Confirm any CI or scripted CLion use does not point at unreviewed project sources.
Questions
Which CLion versions fix CVE-2026-123831?
JetBrains' fixed-issues page lists 2026.2 and 2026.1.4 as the resolved versions.
Does opening a project in Safe Mode fully protect against this flaw?
No. The flaw is that Safe Mode's protection did not hold for a project's Meson settings. JetBrains' fix is the version update, not a Safe Mode workaround.
Is CVE-2026-123831 the same as CVE-2026-123832?
No. JetBrains tracks them as separate CVEs. This one is the Meson vector, fixed in 2026.2 and 2026.1.4. CVE-2026-123832 is a separate JSON compilation database vector, fixed in 2026.2 only.
Is CVE-2026-123831 in the CISA KEV catalogue?
It is not in catalogue version 2026.11.06. The CVE record does not state whether the flaw has been exploited.
In our research
- Patch management Glossary term
- Sandbox Glossary term
Sources
- CVE-2026-123831 Record CVE Program / JetBrains CNA
- CVE-2026-123831 NVD
- Fixed security issues JetBrains
- Project security (CLion help) JetBrains
- Known Exploited Vulnerabilities Catalog CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 151 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.