The vulnerability is a DOM‑based cross‑site scripting flaw in the Jupyter notebook viewer of JetBrains PyCharm before version 2025.3.2. The flaw allows a crafted notebook or an attacker who can inject malicious script into the viewer's JavaScript context to run arbitrary code in the developer’s browser. This can lead to disclosure of local credentials, device compromise, or malicious modification of the development environment.

Any installation of JetBrains PyCharm that includes the Jupyter notebook viewer and is earlier than 2025.3.2 is affected, including community and professional editions used by developers working with Jupyter notebooks.

The flaw scored 8.2 on CVSS and has an EPSS of less than 1 %, meaning it is exploitable but not widely targeted yet. It is not currently listed in the CISA KEV catalog. The likely attack vector is local: an attacker would need to deliver a malicious notebook or influence a trusted user to open an infected file. The weakness aligns with CWE‑79 and can be mitigated by applying the vendor patch or disabling the feature.