Jetbrains Toolbox — known CVE vulnerabilities

Every CVE whose affected-product data names Jetbrains Toolbox, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (11)

• CVE-2020-25207 — CVSS 9.8 (critical): JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler.
• CVE-2025-43012 — CVSS 8.3 (high): In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible
• CVE-2020-25013 — CVSS 7.5 (high): JetBrains ToolBox before version 1.18 is vulnerable to a Denial of Service attack via a browser protocol handler.
• CVE-2020-15827 — CVSS 7.5 (high): In JetBrains ToolBox version 1.17 before 1.17.6856, the set of signature verifications omitted the jetbrains-toolbox.exe file.
• CVE-2019-18368 — CVSS 7.3 (high): In JetBrains Toolbox App before 1.15.5666 for Windows, privilege escalation was possible.
• CVE-2025-43013 — CVSS 6.9 (medium): In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible
• CVE-2025-43014 — CVSS 6.1 (medium): In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation
• CVE-2019-14959 — CVSS 5.9 (medium): JetBrains Toolbox before 1.15.5605 was resolving an internal URL via a cleartext http connection.
• CVE-2024-24943 — CVSS 5.3 (medium): In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image
• CVE-2022-48481 — CVSS 5.2 (medium): In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible
• CVE-2025-42921 — CVSS 4.2 (medium): In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin