Sensitive environment variables were written to session event logs in JetBrains Junie CLI prior to version 26.6.29. This flaw permits disclosure of potentially confidential data—such as credentials, tokens, or key material—that could be leveraged for credential theft, privilege escalation, or other malicious activity. The weakness is an example of improper handling of sensitive information (CWE-532).

JetBrains Junie CLI users running any release before 26.6.29 are affected. No other products or versions are listed.

The vulnerability carries a CVSS score of 5.5, indicating moderate severity. EPSS data is not available and the flaw is not listed in CISA KEV, suggesting that widespread exploitation has not been detected yet. The likely attack vector is any actor who can read the session logs, which may include local users with file system access or remote adversaries if logs are inadvertently exposed through a deployment or configuration setting. If exploited, the impact is primarily the compromise of confidentiality of secrets that were inadvertently logged, with potential downstream effects for systems that rely on those secrets.