In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs
CWE-78