CVE-2022-48481 Code injection in Toolbox App

What is CVE-2022-48481?

CVE-2022-48481 is a medium-severity code injection vulnerability in JetBrains Toolbox App, published on 28 Apr 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible

Weakness: CWE-691

Which versions are affected by CVE-2022-48481?

It affects 1 product.

Products include Jetbrains Toolbox.

How do I fix CVE-2022-48481?

No fix has been published for CVE-2022-48481 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2022-48481 being exploited?

There is no known exploitation of CVE-2022-48481 in the wild and no public exploit code.

Other vulnerabilities in JetBrains Toolbox App

• CVE-2020-25207 Code injection in n/a Critical 9.8
• CVE-2025-43012 In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible High 8.3
• CVE-2020-25013 Denial of service in n/a High 7.5
• CVE-2020-15827 Security feature bypass in n/a High 7.5
• CVE-2019-18368 Privilege escalation in n/a High 7.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vqwh-mv63-c273.