JetBrains CLion Safe Mode Code Execution via JSON Compilation Database (CVE-2026-123832)

CVE-2026-123832 sits in how CLion handles a project opened from a JSON compilation database instead of a CMake, Gradle or Makefile build. JetBrains' fixed-issues page says code execution was possible in Safe Mode through this path, even though Safe Mode exists to block exactly that kind of execution.

How CVE-2026-123832 Reached a 9.6 Severity Score

The CVE record and NVD score CVE-2026-123832 CVSS 3.1 9.6 Critical, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. NVD lists JetBrains' score as a secondary source, and neither record carries a CVSS 4.0 score.

JetBrains assigned CWE-829, inclusion of functionality from an untrusted control sphere, the same weakness class as the sibling flaw CVE-2026-123831. JetBrains' fixed-issues page does not describe which part of a compilation database project bypassed Safe Mode beyond its one-line entry.

What a JSON Compilation Database Project Is

JetBrains' own CLion documentation describes a compilation database as a way to open a project that is not based on CMake, Gradle or Makefiles. The project supplies a file named compile_commands.json. It lists, for every source file, the working directory, the compiler command and the file itself. CLion reads this to get compiler information without a build system.

Is This the Same Flaw as CVE-2026-123831?

No. JetBrains tracks CVE-2026-123832 and CVE-2026-123831 as two separate entries on its fixed-issues page. CVE-2026-123832 is the JSON compilation database vector, resolved in CLion 2026.2 only. CVE-2026-123831 is the Meson project settings vector, resolved in CLion 2026.2 and 2026.1.4.

A different JetBrains IDE had a separate untrusted-project code execution issue the same week. NVD describes CVE-2026-123837 as command injection in untrusted IntelliJ IDEA projects through Tomcat run configurations on WSL, fixed in IntelliJ IDEA 2026.3 and 2026.2.1.

What CISA's Vulnrichment Assessment Says

CISA's Vulnrichment program, acting as an ADP on the CVE record, lists this flaw's exploitation status as none and its automatability as no. As of CISA's Known Exploited Vulnerabilities catalog version 2026.11.06, the CVE is not listed there.

JetBrains' own fixed-issues page lists CVE-2026-123832 as resolved in CLion 2026.2, tracked internally as CPP-50449. The CVE record and NVD state the affected range as CLion before 2026.2.

JetBrains' Project security documentation describes Safe Mode as a general protection against remote code execution from an unfamiliar project. A project opened for the first time shows a Trust dialog. Choosing Safe Mode then lets a developer browse source without running build scripts, startup tasks or other scripted actions. This flaw is one case where that protection did not hold for a compilation database project.

A CLion project supplied as a compilation database by a client, a contractor or an outside contributor falls into this same unfamiliar-project category. JetBrains' own documentation describes that population as the one Safe Mode exists to protect.