Command injection was possible in JetBrains Toolbox App before version 3.6.1 when processing enterprise configuration URLs. This flaw allows an attacker who can influence the configuration URL to inject arbitrary shell commands, potentially gaining full control over the host system. The weakness is identified as CWE‑78, reflecting unsafe execution of system commands.

JetBrains Toolbox App, versions prior to 3.6.1. No specific sub‑versions are listed beyond the stated cutoff. The vulnerability affects all installations that enable or accept enterprise configuration URLs.

The CVSS score of 7.5 indicates a high severity, and the lack of an EPSS score means no publicly available exploitation probability data. The flaw is not currently listed in the CISA KEV catalog, but its nature of command injection suggests that it could be compromised if the application processes untrusted URLs. The likely attack vector is via engineered enterprise configuration URLs that a user or network component can supply, leading to arbitrary command execution on the machine running the Toolbox App. No additional prerequisites are identified in the description beyond the ability to influence the URL.