In JetBrains Toolbox App before version 3.6.1 the application could expose NTLM hash values through SVG tool icons that are fetched from a Remote Development server. The flaw allows an attacker to obtain these hashes, which can be used to impersonate the user or attempt offline cracking. This is an information disclosure vulnerability that can lead to credential compromise.

JetBrains Toolbox App users running any pre‑3.6.1 build are affected. The issue arises when the tool connects to a Remote Development server that provides SVG icons. Any system with the vulnerable application installed and interacting with such a server is impacted.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV catalog. An attacker could exploit this flaw by hosting a malicious Remote Development server or compromising an existing one. The exploit does not require elevated privileges on the client but requires the ability to serve SVG content, which is typically controlled by the remote dev environment. If the attacker succeeds, they receive NTLM hash values that could be leveraged for credential theft or lateral movement.