Datalore published interactive reports allow code execution without authentication
Anyone without a login can secretly run programs on the Datalore data analysis tool.
Summary
In JetBrains Datalore before 2026.2.4, unauthenticated users can execute code via published interactive reports.
Affected when
- Interactive reports published
What to do
Update to version 2026.2.4 or newer.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen