The flaw enables an attacker to run arbitrary code inside JetBrains CLion when the IDE is started in Safe Mode and a project created with Meson is loaded. Safe Mode normally disables certain checks, so the malicious project settings can be used to execute code with the privileges of the user running CLion. This constitutes a high‑impact vulnerability that allows complete compromise of the host system.

JetBrains CLion versions prior to 2026.2, including 2026.1.4, are vulnerable. The issue affects all operating systems supported by CLion and is confined to the IDE itself.

The CVSS score of 9.6 reflects a critical risk. The EPSS score is not available, so the precise probability of exploitation remains unknown, but the flaw has not yet been reported in the CISA KEV catalog. The likely attack vector is that an attacker provides a malicious Meson project file and the victim opens it while CLion is running in Safe Mode, which gives the attacker full control over the local machine. Because the vulnerability requires user interaction to load the exploit, the practical risk is high but not automatic. The absence of active exploits in KEV suggests that current exposure depends on user behavior rather than widespread automated attacks.