Auto-Update Issue in JetBrains Rider by JetBrains
CVE-2026-100265

4.8MEDIUM

Key Information:

Vendor

Jetbrains
Status
Rider
Vendor
CVE Published:
30 September 2026

What is CVE-2026-100265?

In specific versions of JetBrains Rider, the AI Assistant feature has a flaw that allows it to automatically update third-party skills without requiring explicit user consent. This behavior could expose users to potential security risks as unintended software changes can occur without user awareness, highlighting the need for more stringent controls over software updates.

Affected Version(s)

Rider 0 < 2026.2.1

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.