In JetBrains PyCharm versions prior to 2026.3, a crafted Jupyter notebook widget module could be loaded while the IDE was running in Safe Mode, allowing an attacker to execute arbitrary code on the host machine. The vulnerability is a form of insecure code loading, classified as CWE‑829. The impact is that any user running the vulnerable PyCharm instance with Safe Mode enabled could run malicious code with the privileges of the user.

Based on the CVE description, JetBrains PyCharm installations with a release date earlier than 2026.3 are affected. Users of the 2026.2 edition or any earlier version are potentially vulnerable if they use Safe Mode to open notebooks containing a malicious widget module.

The CVSS score of 5.5 indicates a medium level of severity. No EPSS score is available, and the issue is not listed in the CISA KEV catalog, suggesting it is a known but not widely exploited vulnerability. The likely attack would involve tricking a user into opening a specially crafted Jupyter notebook while Safe Mode is active, which would require local or social engineering access to a user’s environment. The vulnerability is therefore best viewed as a local code execution risk that could lead to data exposure or system compromise on the affected machine.