JetBrains patches prompt injection bypass in Junie GitHub Action

JetBrains has fixed a prompt injection protection bypass in its Junie GitHub Action, according to a National Vulnerability Database entry published on 6 November 2026. The flaw, tracked as CVE-2026-123851, affects versions of the action before 1.6.4. The NVD summary states that in JetBrains Junie GitHub Action before 1.6.4, prompt injection protection could be bypassed via HTML-encoded characters.

The entry references JetBrains' own "issues fixed" security page as the source of the advisory. No CVSS severity score is listed in the NVD record, and the published entry does not say who reported the issue, whether it was exploited, or how it was found.

Junie is JetBrains' AI coding agent. The GitHub Action packaging allows it to be run inside continuous integration workflows, where an agent can act on the contents of a repository. That matters for this class of bug, because an agent running in a pipeline typically reads text it did not write, such as issue descriptions, pull request bodies or code comments.

Prompt injection is the technique of hiding instructions in that untrusted text so the model treats them as commands from its operator rather than as data to be processed. Defences against it usually involve filtering or neutralising suspicious input before it reaches the model. A bypass means the filter can be made to miss the malicious instruction while the model still sees it.

The mechanism described in the CVE record, HTML-encoded characters, is a well-known way of representing the same text in a different form. Encoded text can read as harmless to a check that looks for literal strings while still being decoded somewhere later in the chain. The NVD entry does not describe an exploit path or give an example payload, and JetBrains has not published technical detail in the record referenced by the NVD.

Users of the Junie GitHub Action should check which version their workflows pin and move to 1.6.4 or later. Workflows that reference a floating tag rather than a pinned version may already have picked up the fixed release, but that depends on how each repository configures the action.

The disclosure adds to a growing set of CVEs filed against coding agents rather than against the libraries they operate on. In that pattern, the vulnerable component is not the model itself but the glue code around it that decides what the model is allowed to read and do. The Agentic Times has not independently verified the vulnerability and relies here on the NVD record.