JetBrains IntelliJ IDEA: 25 Vulnerabilities Disclosed in Single Batch
A batch of 25 vulnerabilities affecting JetBrains IntelliJ IDEA were disclosed on November 6, 2026, with severities ranging from Low to High.
Key findings
- 25 vulnerabilities in JetBrains IntelliJ IDEA disclosed on November 6, 2026.
- High-severity flaws include multiple instances of code execution and SSRF.
- Vulnerabilities affect various features including Safe Mode, Terraform, plugins, and remote development.
- Path traversal and command injection flaws also present significant risks.
- All issues addressed in IntelliJ IDEA versions 2026.3 and earlier 2026.2.x updates.
JetBrains IntelliJ IDEA Hit by 25 Disclosed Vulnerabilities
On November 6, 2026, a significant batch of 25 vulnerabilities affecting JetBrains IntelliJ IDEA was disclosed, spanning a 6-hour window. These vulnerabilities, with CVSS scores ranging from 3.1 (Low) to 7.8 (High), expose users to risks including code execution, server-side request forgery (SSRF), and path traversal.
Code Execution and Remote Code Execution
A primary concern among the disclosed vulnerabilities is the potential for code execution. CVE-2026-123853 and CVE-2026-123813, both rated High (CVSS 7.8), allow code execution in Safe Mode via project-controlled JVM options in the build process and UI Designer form files, respectively. Additionally, CVE-2026-123849 (High, CVSS 7.0) enables code execution in untrusted projects through Terraform File Watchers. CVE-2026-123841 (High, CVSS 7.8) also permits code execution via symlinks in an imported settings archive, while CVE-2026-123308 (Medium, CVSS 6.3) allows code execution through document import in untrusted projects. CVE-2026-123319 (Medium, CVSS 5.3) involves command execution via a hidden run control in the Markdown preview.
Server-Side Request Forgery (SSRF) and Network-Related Vulnerabilities
Several vulnerabilities revolve around SSRF and network-related exploits. CVE-2026-123844 (Medium, CVSS 5.3) permits SSRF via custom plugin repositories. CVE-2026-123846 (Medium, CVSS 4.3) enables blind SSRF via remote references in JSON Schema validation. CVE-2026-123312 (Low, CVSS 3.3) also involves SSRF via annotations.xml files during indexing. Furthermore, CVE-2026-123848 (High, CVSS 7.4) and CVE-2026-123306 (High, CVSS 7.4) highlight issues with hostname verification for server TLS certificates and improper checks allowing server certificates to be added to the trust store during headless runs, respectively. CVE-2026-123307 (Medium, CVSS 6.8) allows unauthenticated connections to arbitrary hosts via run configurations.
Path Traversal and File Manipulation
Path traversal vulnerabilities were also identified. CVE-2026-123845 (Low, CVSS 3.3) allows path traversal via JSON Schema references in untrusted projects. A more severe path traversal vulnerability, CVE-2026-123305 (High, CVSS 7.5), exists via unpacking Dev Container archives from a remote host. CVE-2026-123842 (High, CVSS 7.1) permits arbitrary file writes via symlinks when extracting plugin archives.
Other Notable Vulnerabilities
Other vulnerabilities include command execution via control characters in terminal command completion (CVE-2026-123847, Medium, CVSS 5.3), HTML injection in Remote Development editor tabs (CVE-2026-123840, Medium, CVSS 4.7), and the possibility of opening arbitrary URLs without confirmation via the Remote Development port forwarding model (CVE-2026-123839, Medium, CVSS 4.7). Additionally, CVE-2026-123314 (Low, CVSS 3.1) describes an XXE attack via an XML response to an HTTP Client request, and CVE-2026-123313 (Low, CVSS 3.3) points to improper checks enabling disabled plugins. CVE-2026-123310 (Medium, CVSS 5.4) could trigger dependency downloads from arbitrary repositories in untrusted projects via Kotlin scripts, and CVE-2026-123309 (Medium, CVSS 6.1) involves stored XSS on the built-in web server via Markdown preview.
Response and Mitigation
All of these vulnerabilities were addressed in IntelliJ IDEA versions 2026.3, 2026.2.1, 2026.2.2, and 2026.2.4. Users are strongly advised to update to the latest available versions to mitigate these security risks. The wide range of vulnerabilities underscores the importance of timely patching and security awareness when working with integrated development environments.
This extensive disclosure highlights the need for continuous vigilance in software security. Developers and organizations using IntelliJ IDEA should prioritize updating their installations to protect against potential exploitation of these newly revealed weaknesses.