In JetBrains Junie before 252.549.29 command execution was possible via malicious project file
CWE-77, CWE-77