A DOM-based cross-site scripting vulnerability in JetBrains PyCharm allows unauthenticated attackers to execute malicious scripts, posing a significant risk to user sessions.

This is a DOM-based cross-site scripting (CWE-79) flaw located on the Jupyter viewer page. The vulnerability does not require authentication to trigger, as it relies on user interaction within the browser environment.

The ability for an attacker to execute arbitrary scripts in a user's browser can lead to the theft of session tokens, sensitive data exfiltration, or the unauthorized modification of displayed information. With a CVSS score of 8.2, this high-severity vulnerability represents a substantial risk to internal development environments where PyCharm is utilized to handle proprietary code and data.

Immediate Action: Update JetBrains PyCharm to version 2025.3.2 or later to resolve the underlying DOM-based XSS vulnerability.

Proactive Monitoring: Monitor web server access logs for anomalous requests directed toward Jupyter viewer components or unexpected script execution patterns within the local development environment.

Compensating Controls: Deploy a Content Security Policy (CSP) to restrict script execution sources and ensure that browser-based security features are configured to mitigate XSS risks until the update can be applied.

Public Exploit Available: No — exploit_available is false and no weaponized or public proof-of-concept exists in the provided data.

Given the high CVSS score, organizations should prioritize the update of all PyCharm instances to the patched version. Ensuring that development workstations are running the latest software version is critical to preventing potential script injection attacks that could compromise sensitive intellectual property.