CVE-2026-75059

Executive Summary

CVE-2026-75059 is a medium-severity (CVSS 3.1 base score 4.4) client-side code execution vulnerability in JetBrains PyCharm versions prior to 2026.2.1. The flaw is rooted in the Quick Documentation feature, where crafted documentation content rendered in the IDE can lead to code execution in the context of the developer's session. Affected users are developers who open untrusted projects, clone untrusted repositories, or install untrusted Python packages, and who then inspect symbols using Quick Documentation. Impact is limited to local confidentiality and integrity compromise, but the trusted position of a developer workstation creates significant downstream supply-chain risk.

Technical Analysis

The NVD description for CVE-2026-75059 is intentionally brief: "In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible." No CNA title, no vendor advisory, no patch source, and no CISA KEV entry were provided in the intelligence data. Structured fields identify the vulnerability class as CWE-79 (Improper Neutralization of Input During Web Page Generation), and the CVSS vector confirms the local, interactive attack model.

At the vulnerability-class level, the mechanism is as follows. PyCharm's Quick Documentation feature renders a popup containing the signature, docstring, and associated HTML markup for any symbol under the mouse cursor when the user presses the Quick Documentation shortcut or hovers over the symbol. Python docstrings commonly contain markup (reStructuredText, Epydoc fields, or raw HTML) that the IDE renders as rich text. CWE-79 indicates that the IDE's documentation rendering pipeline fails to neutralize embedded scripts or event-handler attributes before rendering. In effect, the vulnerability is a stored/contextual cross-site scripting defect transplanted from the web browser world into the IDE's embedded HTML renderer. The description's use of the term "code execution" strongly implies that script execution in the documentation view is not confined to the renderer's sandbox, and that it can be escalated to execute code in the host environment.

Attack surface: every code path that feeds content into the Quick Documentation popup — module docstrings, class/function/attribute docstrings, type stub comments, and documentation metadata delivered inside packages. Delivery surface: any mechanism that gets a malicious Python file or package onto a developer's machine, including typosquatted packages on public package registries, malicious code contributions to shared repositories, or forged project archives.

Specific function names, URL endpoints, file paths, or parameters are not disclosed in publicly sourced data; per the accuracy rules of this report, no such implementation details are invented. The analysis above is inferred from CWE-79, the CVSS vector, and the NVD description only. Insufficient technical detail is available from public sources to describe the exact function-level execution chain.

Exploitation Scenarios

No public PoC is available, and exploit status is unknown. The attack chain presented below is inferred at the vulnerability-class level from CWE-79 and the NVD description, and is therefore bounded by what the class of flaw permits rather than by confirmed implementation specifics.

1. Reconnaissance and target identification. The attacker selects Python developers or engineering organizations that use JetBrains PyCharm versions before 2026.2.1. Public signals such as GitHub profiles, Stack Overflow activity, LinkedIn job descriptions, or leaked configuration files can reveal the IDE in use. The goal is to identify a target whose workstation — if compromised — provides access to source code, credentials, or CI/CD pipelines.

2. Triggering the flaw. The attacker crafts a malicious Python package or a malicious contribution to an existing codebase. The attack payload is placed inside documentation content, e.g., a module or function docstring containing HTML and JavaScript. The victim installs the package or clones the repository and, during normal development, invokes Quick Documentation on a symbol that exposes the malicious content. The user interaction requirement (UI:R in the CVSS vector) is satisfied by this single, routine action — hovering over a symbol or pressing the Quick Documentation shortcut.

3. Payload and execution method at class level. Because the documentation renderer lacks proper neutralization (CWE-79), the embedded script executes when the documentation view is rendered. At the class level, this allows the script to operate with whatever privileges the IDE's renderer grants to embedded content. The description's "code execution" outcome indicates that the script can break out of the content-rendering context and invoke host-level capabilities available to the IDE process — for example, spawning an interpreter or shell, reading and writing local files, or accessing IDE-stored credentials. The exact bridge used is not disclosed publicly, and no specific function names or APIs are claimed in this report.

4. Post-exploitation impact. With code execution in the developer session, the attacker can read local source code, modify project files to inject backdoors, steal stored SSH keys, cloud credentials, and package-registry tokens, and tamper with the developer's signing or publishing configuration. In a software supply-chain scenario, a single compromised developer machine can be used to publish a malicious update to a widely consumed package, amplifying the blast radius far beyond the single workstation.

Impact Assessment

The CVSS score of 4.4 places this at the high end of the Medium severity band. The vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N indicates: local attack vector (the malicious project must already be present on the host), low attack complexity, no prior privileges required, user interaction required, no scope change, low confidentiality impact, low integrity impact, and no availability impact.

Business impact is most acute in software development organizations. Although confidentiality and integrity impacts are individually rated low, the affected asset — a developer workstation with access to source code, secrets, and release pipelines — is disproportionately valuable. A successful exploit enables an attacker to plant backdoors in source code or published packages, turning one CVE into a supply-chain event affecting downstream customers. The integrity impact is therefore compounded by the trust relationships that depend on developer output.

Affected systems are all JetBrains PyCharm installations prior to 2026.2.1. Because the intelligence data lists no affected version ranges beyond the description, this report treats "before 2026.2.1" as the authoritative scope. No EPSS score has been assigned by FIRST.org, and the CISA KEV catalog contains no entry, indicating no confirmed exploitation in the wild as of analysis time.

Detection Guidance

Detection of this vulnerability is challenging because exploitation occurs inside a GUI application and may not produce traffic on the network. The highest-fidelity detections are endpoint-based: they observe unusual child-process activity from the PyCharm process tree, or the presence of script-laden documentation content in source files. Network detections are lower fidelity and are provided for completeness.

Sigma Rule

title: Suspicious Child Process Spawned by JetBrains PyCharm
id: 8f6c4e2a-5b91-4c3d-9a7e-2b1d0f6c9a43
status: experimental
description: Detects shell or interpreter processes spawned from a PyCharm parent process, which may indicate code execution via the Quick Documentation flaw (CVE-2026-75059)
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75059
    - https://attack.mitre.org/techniques/T1203/
author: ValtersIT Threat Intelligence
date: 2026
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\pycharm64.exe'
            - '\pycharm.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\python.exe'
            - '\pythonw.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Developers deliberately running build tools or helper scripts from within the IDE terminal
    - IDE plugin or test runner behavior that spawns helper processes
level: medium
tags:
    - attack.execution
    - attack.t1203
    - cve.2026.75059

YARA Rule

rule CVE_2026_75059_PyCharm_Doc_Payload
{
    meta:
        description = "Detects HTML/JavaScript injection patterns in Python docstrings that may be used to trigger code execution via PyCharm Quick Documentation (CVE-2026-75059)"
        author = "ValtersIT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75059"
        severity = "medium"

    strings:
        $doc_triple = "\"\"\"" ascii
        $script_open = "<script" ascii nocase
        $script_close = "</script>" ascii nocase
        $event_handler = "onerror=" ascii nocase
        $event_handler2 = "onload=" ascii nocase
        $iframe = "<iframe" ascii nocase
        $eval = "eval(" ascii nocase

    condition:
        uint16(0) == 0x0A0D or uint32(0) == 0x000003B3 // PE or ELF guard to reduce false hits on binaries
        and filesize < 1MB
        and $doc_triple
        and 2 of ($script_open, $script_close, $event_handler, $event_handler2, $iframe, $eval)
}

Suricata IDS Rule

# Heuristic detection: crafted documentation content containing script payloads
# delivered to a developer host. This rule targets the delivery leg of the attack
# chain (malicious package or repository download) and is low-fidelity by design.
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CVE-2026-75059 PyCharm Quick Documentation Payload Delivery"; flow:established,to_client; content:"<script"; nocase; content:"PyCharm"; nocase; distance:0; within:2000; classtype:attempted-user; sid:2026759; rev:1;)

# Detection of a response containing Python docstring markers plus script material,
# indicating a potentially malicious package or documentation file in transit.
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET CVE-2026-75059 Docstring With Embedded Script Over HTTP"; flow:established,to_client; content:"\"\"\""; content:"<script"; nocase; distance:0; within:5000; classtype:attempted-user; sid:2026760; rev:1;)

Elastic Detection

process where event.code == "1" and
  process.parent.name in ("pycharm64.exe", "pycharm.exe") and
  process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "python.exe", "python3", "sh", "bash")

Splunk SPL Query

index=endpoint (EventCode=4688 OR sourcetype="WinEventLog:Security")
| where match(parentProcessName, "(?i)pycharm")
| search (NewProcessName="*cmd.exe" OR NewProcessName="*powershell.exe" OR NewProcessName="*pwsh.exe" OR NewProcessName="*wscript.exe" OR NewProcessName="*cscript.exe" OR NewProcessName="*python*.exe")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, parentProcessName, NewProcessName, CommandLine
| where count >= 1

Wazuh OSSEC Rule

<rule id="100750" level="12">
  <if_sid>92050</if_sid>
  <field name="win.eventdata.parentName">(?i)pycharm</field>
  <field name="win.eventdata.newName">(?i)\\(cmd|powershell|pwsh|wscript|cscript|python|pythonw)\.exe</field>
  <description>CVE-2026-75059: Possible code execution via PyCharm Quick Documentation - child process spawned by IDE</description>
  <group>pycharm,cve-2026-75059,execution,t1203,</group>
</rule>

Mitigation & Patch Guidance

Patch confidence is rated 0/4 (UNPATCHED): no patch evidence from any tracked source. Despite the NVD description implying that PyCharm 2026.2.1 resolves the issue, no vendor advisory was confirmed by the tracked patch sources feeding this report. Treat the fixed version as unreported until JetBrains publishes an advisory.

Immediate mitigations:

1. Disable or restrict Quick Documentation until a verified fix is available. In PyCharm, disable the "Show quick documentation on mouse move" option and avoid invoking Quick Documentation on symbols originating from untrusted packages or repositories.
2. Enforce a policy against opening untrusted projects, cloning unknown repositories, or installing packages outside an approved registry mirror. Treat documentation content as executable input.
3. Run the IDE under a least-privilege operating system account and sandbox it where possible, limiting the damage of host-level code execution.

Patch and upgrade steps:

1. Monitor JetBrains security advisories (https://www.jetbrains.com/security/) and the PyCharm release notes for confirmation of a fix.
2. Once confirmed, upgrade PyCharm to 2026.2.1 or later in a staged rollout: validate in a test environment, then deploy via managed endpoints.
3. If 2026.2.1 does not yet exist or the advisory is not published, do not downgrade the patch confidence to "patched" — continue with mitigations above.

Long-term hardening:

1. Maintain IDE and plugin update policies with enforced patch SLAs for end-user development tools, not just servers.
2. Deploy endpoint detection and response (EDR) baselines that alert on IDE process trees spawning interpreters or shells, as modeled in the detection rules above.
3. Implement software provenance controls for Python dependencies (private mirrors, pinned versions, hash verification) to reduce exposure to malicious packages.
4. Educate developers that docstrings and documentation views are part of the attack surface of modern IDEs, and that hovering over documentation in an untrusted project is a risky action.

References

1. NVD entry for CVE-2026-75059 — https://nvd.nist.gov/vuln/detail/CVE-2026-75059
2. JetBrains Security Advisories portal — https://www.jetbrains.com/security/
3. JetBrains PyCharm release notes / What's New — https://www.jetbrains.com/pycharm/whatsnew/
4. MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation — https://cwe.mitre.org/data/definitions/79.html
5. MITRE ATT&CK Technique T1203 — Exploitation for Client Execution — https://attack.mitre.org/techniques/T1203/

Known threat actor campaigns: none identified in the provided intelligence data. Exploit-in-the-wild evidence: none; CISA KEV does not list this CVE. EPSS: not yet scored by FIRST.org.