Command Injection Vulnerability in JetBrains Toolbox App SSH Plugin
CVE-2025-43012

8.3HIGH

Key Information:

Vendor

Jetbrains
Status
Toolbox App
Vendor
CVE Published:
17 April 2025

What is CVE-2025-43012?

A security flaw in the JetBrains Toolbox App prior to version 2.6 allows for command injection through the SSH plugin. Attackers can exploit this vulnerability to execute arbitrary commands on the server, potentially leading to unauthorized access or further exploitation of system resources.

Affected Version(s)

Toolbox App 0 < 2.6

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-43012 : Command Injection Vulnerability in JetBrains Toolbox App SSH Plugin