In JetBrains Junie before 252.549.29 command execution was possible via malicious project fileReferenceshttps://www.jetbrains.com/privacy-security/issues-fixed/