CVE-2026-123281: JetBrains Datalore: argument injection allows sidecar command execution

HIGH

Published November 6, 2026

CISO Take

JetBrains Datalore versions before 2026.4 contain an argument injection flaw (CWE-88) in the mount broker. Notebook code can use it to run commands in the sidecar container, which sits outside the sandbox the notebook is meant to be confined to. The CVSS score is 7.5 (high) with high impact on confidentiality, integrity and availability. Exploitation needs network access and a low-privileged account, and the attack complexity is rated high. There is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so mass exploitation is unlikely in the short term. The risk is greatest for shared or multi-tenant Datalore deployments where less-trusted users can run notebook code, and any sidecar with access to data sources, credentials or cloud storage widens the blast radius. Upgrade to Datalore 2026.4 or later, and until then limit notebook access to trusted users and review what the sidecar can reach.

Sources:NVDATLASjetbrains.com

What is the risk?

Medium-high. The CVSS base score is 7.5 with full CIA impact, but exploitation needs an authenticated low-privilege user and high attack complexity. There is no KEV listing, public exploit, scanner template or EPSS data, so near-term exploitation likelihood is low to moderate. Exposure is highest where Datalore is shared among many users or runs on an internet-reachable network. Package telemetry (dependents, scorecard) is unavailable, so adoption and blast radius cannot be quantified from the data we have.

How does the attack unfold?

Initial Access

The attacker signs in to Datalore with a low-privilege account and creates or opens a notebook.

AML.T0012

Exploitation

Notebook code sends crafted arguments to the mount broker, and argument injection runs commands in the sidecar container.

AML.T0050

Escape

Execution moves out of the notebook sandbox into the sidecar container, which has broader access.

AML.T0105

Impact

The attacker reads mounted datasets and credentials, exfiltrates data or disrupts the platform.

AML.T0025

Initial Access

The attacker signs in to Datalore with a low-privilege account and creates or opens a notebook.

AML.T0012

Exploitation

Notebook code sends crafted arguments to the mount broker, and argument injection runs commands in the sidecar container.

AML.T0050

Escape

Execution moves out of the notebook sandbox into the sidecar container, which has broader access.

AML.T0105

Impact

The attacker reads mounted datasets and credentials, exfiltrates data or disrupts the platform.

AML.T0025

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade JetBrains Datalore to 2026.4 or later, as listed in the JetBrains security advisories (jetbrains.com/privacy-security/issues-fixed/). 2) Until patched, restrict notebook creation and execution to trusted users and remove untrusted or guest access. 3) Apply least privilege to the sidecar container: drop unneeded capabilities, use a read-only filesystem where possible, and limit network egress and the credentials and mounts it can reach. 4) Rotate credentials and secrets reachable from the sidecar if untrusted users had notebook access. 5) Detection: monitor container runtime logs for unexpected process spawns in the sidecar, unusual arguments passed to the mount broker, and unexpected outbound connections from the sidecar.

How is it classified?

Code ExecutionFrameworkPluginAML.T0050- Command and Scripting Interpreter AML.T0105- Escape to Host

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to and recover from previously unknown risks

Frequently Asked Questions

What is CVE-2026-123281?

Is CVE-2026-123281 actively exploited?

No confirmed active exploitation of CVE-2026-123281 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123281?

1) Upgrade JetBrains Datalore to 2026.4 or later, as listed in the JetBrains security advisories (jetbrains.com/privacy-security/issues-fixed/). 2) Until patched, restrict notebook creation and execution to trusted users and remove untrusted or guest access. 3) Apply least privilege to the sidecar container: drop unneeded capabilities, use a read-only filesystem where possible, and limit network egress and the credentials and mounts it can reach. 4) Rotate credentials and secrets reachable from the sidecar if untrusted users had notebook access. 5) Detection: monitor container runtime logs for unexpected process spawns in the sidecar, unusual arguments passed to the mount broker, and unexpected outbound connections from the sidecar.

What systems are affected by CVE-2026-123281?

This vulnerability affects the following AI/ML architecture patterns: Collaborative notebook platforms, Training pipelines, Data preparation and analytics workspaces, Containerized ML development environments.

What is the CVSS score for CVE-2026-123281?

CVE-2026-123281 has a CVSS v3.1 base score of 7.5 (HIGH).

What is the AI security impact?

Affected AI Architectures

Collaborative notebook platformsTraining pipelinesData preparation and analytics workspacesContainerized ML development environments

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

AML.T0105Escape to Host

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker

Exploitation Scenario

An attacker with a low-privilege Datalore account, such as a contractor or a compromised analyst login, creates a notebook and runs code that sends crafted arguments to the mount broker, using argument injection (CWE-88) to add unintended options or commands. The broker passes them to a command in the sidecar container, which then runs attacker-controlled commands outside the notebook sandbox. From the sidecar the attacker reads mounted datasets and stored credentials, then exfiltrates sensitive training data or model artifacts, or pivots to connected data warehouses and cloud storage.

Weaknesses (CWE)

CWE-88Improper Neutralization of Argument Delimiters in a CommandPrimary CWE-88Improper Neutralization of Argument Delimiters in a Command

CWE-88 — Improper Neutralization of Argument Delimiters in a Command: The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

[Implementation] Where possible, avoid building a single string that contains the command and its arguments. Some languages or frameworks have functions that support specifying independent arguments, e.g. as an array, which is used to automatically perform the appropriate quoting or escaping while building the command. For example, in PHP, escapeshellarg() can be used to escape a single argument to system(), or exec() can be called with an array of arguments. In C, code can often be refactored from using system() - which accepts a single string - to using exec(), which requires separate function arguments for each parameter.
[Architecture and Design] Understand all the potential areas where untrusted inputs can enter your product: parameters or arguments, cookies, anything read from the network, environment variables, request headers as well as content, URL components, e-mail, files, databases, and any external systems that provide data to the application. Perform input validation at well-defined interfaces.

Source: MITRE CWE corpus.