Executive brief
JetBrains PyCharm, a popular integrated development environment (IDE) for Python developers, was vulnerable to a security flaw in how it handles Jupyter notebooks. An attacker could create a malicious notebook that, when opened by a user, executes unauthorized scripts within the IDE interface. This could lead to the theft of sensitive information or unauthorized actions performed on behalf of the user.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in JetBrains PyCharm versions prior to 2025.3.4. The flaw is located in the rendering of Markdown cells within Jupyter notebooks, where the application fails to properly neutralize user-supplied input (CWE-79). An attacker can exploit this by distributing a specially crafted .ipynb file; when a victim opens the file and the Markdown cell is rendered, malicious JavaScript executes in the context of the IDE's internal web view. This requires user interaction (opening the file) but no prior authentication. The vulnerability has been addressed in PyCharm version 2025.3.4.
Affected products
- JetBrains PyCharm before 2025.3.4
Timeline
- 2026-05-29: advisory: CVE-2026-49384 published by JetBrains