JetBrains Hub before version 2026.2.52556 suffered a command injection flaw in its email verification process, allowing injection of arbitrary SMTP commands into the verification sequence. This weakness, identified as CWE‑93, can potentially lead to unauthorized command execution on the Hub server, compromising confidentiality, integrity, and availability of the system.

The vulnerability affects JetBrains Hub installations running any version earlier than 2026.2.52556. Users of the affected releases must verify their current version and ensure it is not within the vulnerable range.

The CVSS score of 5 indicates moderate severity, but the EPSS score is not available, so exploitation likelihood is uncertain. The description indicates SMTP command injection in the email verification process; however, the level of access required for exploitation is not specified. Based on the description, it is inferred that an attacker capable of triggering the email verification flow could potentially inject arbitrary SMTP commands. The vulnerability is not listed in the CISA KEV catalog, which may reduce immediate exposure concerns.