CVE-2026-123854: PyCharm: Safe Mode bypass via Jupyter widget module

MEDIUM

Published November 6, 2026

CISO Take

JetBrains PyCharm before 2026.3 lets a crafted Jupyter notebook run code even when the project is opened in Safe Mode, the feature meant to stop untrusted projects from executing anything. Safe Mode is the control developers rely on when they open notebooks from outside sources, so this removes the main guardrail against malicious notebooks from repositories, shared drives, or model-hub downloads. Exposure is limited: it needs local access and user interaction (CVSS 5.5, medium). There is no KEV listing, no public exploit, no Nuclei template, and no EPSS data, so there is no sign of active exploitation. Upgrade PyCharm to 2026.3 or later, and until then treat notebooks from outside sources as untrusted even in Safe Mode and open them only in isolated environments.

Sources:NVDATLASjetbrains.com

What is the risk?

Medium overall. The CVSS vector (AV:L/AC:L/PR:N/UI:R) shows the attacker must get a victim to open a malicious notebook, but exploitation is simple once that happens. The scored impact is high confidentiality (C:H) only. However, arbitrary code execution on a developer workstation can reach source code, cloud credentials, API keys, and data science datasets, so real impact can exceed the score. There is no known exploitation, no public PoC, and no EPSS data. The weakness is CWE-829 (inclusion of functionality from an untrusted control sphere), which here means loading an untrusted widget module. The main danger is targeted attacks against data scientists and ML engineers who routinely open third-party notebooks.

How does the attack unfold?

Delivery

Attacker distributes a crafted Jupyter notebook with a malicious widget module through a repository, shared drive, or download.

AML.T0011.000

Execution

Victim opens the notebook in PyCharm Safe Mode and the widget module runs code despite the restriction.

AML.T0050

Collection

Payload reads credentials, API keys, datasets, and source code from the developer workstation.

AML.T0037

Impact

Stolen data and credentials give the attacker access to training infrastructure, model registries, and code repositories.

AML.T0025

Delivery

Attacker distributes a crafted Jupyter notebook with a malicious widget module through a repository, shared drive, or download.

AML.T0011.000

Execution

Victim opens the notebook in PyCharm Safe Mode and the widget module runs code despite the restriction.

AML.T0050

Collection

Payload reads credentials, API keys, datasets, and source code from the developer workstation.

AML.T0037

Impact

Stolen data and credentials give the attacker access to training infrastructure, model registries, and code repositories.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Jupyter	pip	—	No patch
13.5KOpenSSF 5.81.9K dependentsPushed 7d ago53% patched~28d to patchFull package profile →

Do you use Jupyter? You're affected.

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACLow

PRNone

UIRequired

SUnchanged

CHigh

INone

ANone

What should I do?

6 steps

Update PyCharm to 2026.3 or later across all developer machines and confirm versions via endpoint inventory.
Until patched, do not open notebooks from untrusted sources in PyCharm; use isolated VMs, containers, or disposable environments.
Do not rely on Safe Mode alone for untrusted notebooks.
Review notebooks for custom widget modules or unexpected JavaScript/Python module references before opening.
Limit credentials stored on developer workstations and use short-lived tokens.
Detection: monitor for unexpected child processes spawned by the PyCharm process, and for outbound connections from the IDE shortly after a notebook is opened.

How is it classified?

Code ExecutionSupply ChainFrameworkPluginAML.T0010.001- AI Software AML.T0011.000- Unsafe AI Artifacts AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

GOVERN 6.1-Policies for third-party AI and software risk

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-123854?

Is CVE-2026-123854 actively exploited?

No confirmed active exploitation of CVE-2026-123854 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123854?

1. Update PyCharm to 2026.3 or later across all developer machines and confirm versions via endpoint inventory. 2. Until patched, do not open notebooks from untrusted sources in PyCharm; use isolated VMs, containers, or disposable environments. 3. Do not rely on Safe Mode alone for untrusted notebooks. 4. Review notebooks for custom widget modules or unexpected JavaScript/Python module references before opening. 5. Limit credentials stored on developer workstations and use short-lived tokens. 6. Detection: monitor for unexpected child processes spawned by the PyCharm process, and for outbound connections from the IDE shortly after a notebook is opened.

What systems are affected by CVE-2026-123854?

This vulnerability affects the following AI/ML architecture patterns: Developer workstations / IDEs, Jupyter notebook workflows, Training pipelines, ML experimentation environments.

What is the CVSS score for CVE-2026-123854?

CVE-2026-123854 has a CVSS v3.1 base score of 5.5 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

Developer workstations / IDEsJupyter notebook workflowsTraining pipelinesML experimentation environments

MITRE ATLAS Techniques

AML.T0010.001AI Software

AML.T0011.000Unsafe AI Artifacts

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module

Exploitation Scenario

An attacker publishes a helpful-looking ML tutorial notebook, or submits one in a pull request to a shared repository, containing a crafted Jupyter widget module. A data scientist opens the project in PyCharm and keeps Safe Mode on, expecting that to block execution. Opening and interacting with the notebook triggers the widget module and runs attacker code with the user's privileges. The payload reads cloud credentials, API keys, and local datasets, and sends them to the attacker, who can then pivot into training infrastructure or the model registry.

Weaknesses (CWE)

CWE-829Inclusion of Functionality from Untrusted Control SpherePrimary CWE-829Inclusion of Functionality from Untrusted Control Sphere

CWE-829 — Inclusion of Functionality from Untrusted Control Sphere: The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].
[Architecture and Design] When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs. For example, ID 1 could map to "inbox.txt" and ID 2 could map to "profile.txt". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.

Source: MITRE CWE corpus.