This vulnerability is a race condition in JetBrains Datalore that allows an attacker to upload an init script and cause arbitrary code execution inside another user’s computation. By manipulating the order of script handling, a malicious actor can trigger the execution of malicious code with the privileges of the target computation. The weakness is categorized as CWE‑367, which is a classic race condition that can lead to execution of unintended code.

JetBrains Datalore versions earlier than 2026.4 are affected. Users running any pre‑2026.4 release may be vulnerable to this race condition via the init script upload feature.

The CVSS score of 5.9 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed. However, because execution is possible inside another user's computation, the potential impact spans confidentiality, integrity and availability of the computational session. The attack vector is likely remote or via authenticated access to the Datalore environment, as the attacker must upload a script. Inference: if an attacker has any form of access to the upload functionality, the race condition can be leveraged. The lack of public exploits does not eliminate risk, especially in multi‑tenant or shared‑resource environments.