JetBrains Intellij Idea

IntelliJ IDEA Pre2026.2.1 xXE via Eclipse Settings Importer
CVE-2026-75058 5.5 - Medium - August 17, 2026

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers

XXE

IntelliJ IDEA <2026.1.5 - Git Credentials Logged in Plaintext
CVE-2026-75057 6.2 - Medium - August 17, 2026

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log

Insertion of Sensitive Information into Log File

Remote Code Exec in IntelliJ IDEA <2026.2.1 via Markdown Export
CVE-2026-75056 7.8 - High - August 17, 2026

In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible

Shell injection

IntelliJ IDEA <2026.2.1, Hadoop ResourceManager XXE Local File Read
CVE-2026-75055 5.5 - Medium - August 17, 2026

In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE

XXE

IntelliJ IDEA <2026.2.1 sSRF via OpenAPI preview proxy
CVE-2026-75054 6.3 - Medium - August 17, 2026

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects

SSRF

SRF in JetBrains IntelliJ IDEA < 2026.2.1 via DevKit Debug Listener
CVE-2026-75053 5.4 - Medium - August 17, 2026

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint

SSRF

CVE-2026-75052: CMD exec via Markdown preview in IntelliJ IDEA < 2026.2.1
CVE-2026-75052 3.6 - Low - August 17, 2026

In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects

Command Injection

IntelliJ IDEA UI Designer Form Files Code Injection <2026.2
CVE-2026-64815 8.1 - High - July 23, 2026

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

Code Injection

IntelliJ IDEA <2026.2 Remote Dev Unauth File Access
CVE-2026-64814 8.6 - High - July 23, 2026

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

AuthZ

IntelliJ IDEA <2026.2 unauthorized input injection in Remote Dev session
CVE-2026-64812 10 - Critical - July 23, 2026

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

Missing Authentication for Critical Function

Unauthorized Settings Mod in IntelliJ IDEA <2026.2 Remote Dev
CVE-2026-64813 10 - Critical - July 23, 2026

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session

Client-Side Enforcement of Server-Side Security

JetBrains IntelliJ IDEA <2026.2: Dev Cont Config Assignor ATE
CVE-2026-64811 7.8 - High - July 23, 2026

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration

Inclusion of Functionality from Untrusted Control Sphere

JetBrains IntelliJ IDEA 2026.1: HTML Injection in IDE Notifications
CVE-2026-64810 4.3 - Medium - July 23, 2026

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking

XSS

JetBrains IntelliJ IDEA <2026.1.4: Path Traversal Exec via Workspace ID
CVE-2026-59792 9.6 - Critical - July 10, 2026

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

Relative Path Traversal

JETBRAINS INTELLIJ IDEA <2026.1 UI Designer XXE in Form Parser
CVE-2026-49383 3.3 - Low - May 29, 2026

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

XXE

IntelliJ IDEA <2026.1: Template Injection Exec CVE-2026-49382
CVE-2026-49382 4.5 - Medium - May 29, 2026

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin

1336

JetBrains IntelliJ IDEA command execution via Guest assigner before 2026.1.1
CVE-2026-49367 8 - High - May 29, 2026

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

AuthZ

Command Injection in JetBrains IntelliJ IDEA < 2026.1.1
CVE-2026-49366 7.8 - High - May 29, 2026

In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion

Shell injection

Arbitrary File Read via JetBrains IntelliJ IDEA Built-in Web Server (2026.1.1)
CVE-2026-41882 7.4 - High - April 30, 2026

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server

insecure temporary file

JetBrains IntelliJ IDEA <2025.3: SSH Remote Project Confirmation Bypass
CVE-2025-68269 5.4 - Medium - December 16, 2025

In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH

Acceptance of Extraneous Untrusted Data With Trusted Data

CVE-2025-57730: HTML Injection via Remote Dev in IntelliJ IDEA < 2025.2
CVE-2025-57730 - August 20, 2025

In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature

Basic XSS

JetBrains IntelliJ IDEA pre-2025.2: Remote Credentials Disclosure
CVE-2025-57727 - August 20, 2025

In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference

Cleartext Transmission of Sensitive Information

IntelliJ IDEA <2025.2: Code With Me Guest Hidden File Disclosure
CVE-2025-57728 - August 20, 2025

In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files

AuthZ

JetBrains IntelliJ IDEA <=2025.1 LSP Auto-Start Enables Unexpected Plugin Launch
CVE-2025-57729 - August 20, 2025

In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start

Inclusion of Functionality from Untrusted Control Sphere

JetBrains IntelliJ IDEA <2024.3: Source code logged in idea.log
CVE-2025-32054 - April 03, 2025

In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file

Insertion of Sensitive Information into Log File

JetBrains IntelliJ IDEA (<2024.1) hTML Injection via Project Name
CVE-2024-46970 6.1 - Medium - September 16, 2024

In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible

XSS

JetBrains IDEs <=2024.2 Token Exposure via 3rd-Party Sites (CVE-2024-37051)
CVE-2024-37051 7.5 - High - June 10, 2024

GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4

Insufficiently Protected Credentials

IntelliJ IDEA Space plugin sends auth token to wrong URL before 2023.3.3
CVE-2024-24941 5.3 - Medium - February 06, 2024

In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL

Improper Input Validation

IntelliJ IDEA 2023.3.3 Path Traversal via Archive Unpacking
CVE-2024-24940 4.3 - Medium - February 06, 2024

In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives

Relative Path Traversal

IntelliJ IDEA < 2023.3.2: Untrusted Mode Code Exec via Malicious Plugin Repo
CVE-2023-51655 9.8 - Critical - December 21, 2023

In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration

Insufficient Verification of Data Authenticity

IntelliJ IDEA Local Info Disclosure via Confused Deputy in StatusHints
CVE-2023-21283 5.5 - Medium - August 14, 2023

In multiple functions of StatusHints.java, there is a possible way to reveal images across users due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

IntelliJ IDEA Space plugin excessive permissions before 2023.2
CVE-2023-39261 7.8 - High - July 26, 2023

In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions

Execution with Unnecessary Privileges

IntelliJ IDEA < 2023.1.4: License Dialog Suppression Vulnerability
CVE-2023-38069 3.3 - Low - July 12, 2023

In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases

Improper Check for Unusual or Exceptional Conditions

IntelliJ IDEA Chromium Sandbox Bypass (pre-2023.1)
CVE-2022-48432 8.8 - High - March 29, 2023

In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.

Insecure Default Initialization of Resource

IntelliJ IDEA <=2023.1 Disclosure via External CSS in MD Preview
CVE-2022-48430 7.5 - High - March 29, 2023

In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview.

Trust Project Prompt Bypass in JetBrains IntelliJ IDEA <2023.1
CVE-2022-48431 7.8 - High - March 29, 2023

In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the Trust Project confirmation.

Insufficient Verification of Data Authenticity

IntelliJ IDEA <=2022.3. NTLM Hash Leak via API in Builtin Web Server
CVE-2022-48433 7.5 - High - March 29, 2023

In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.

Insufficiently Protected Credentials

IntelliJ IDEA SSTI via Code Templates before 2022.3.1
CVE-2022-47896 7.8 - High - December 22, 2022

In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.

Code Injection

IntelliJ IDEA<2022.3.1: Validate JSP File uses HTTP to download JARs
CVE-2022-47895 7.5 - High - December 22, 2022

In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files.

Cleartext Transmission of Sensitive Information

IntelliJ IDEA fsnotifier Buffer Overflow on macOS before 2022.2.4
CVE-2022-46824 7.8 - High - December 08, 2022

In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible.

Classic Buffer Overflow

DYLIB Injection in JetBrains IntelliJ IDEA < 2022.3 on macOS
CVE-2022-46828 7.8 - High - December 08, 2022

In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.

Unrestricted File Upload

IntelliJ IDEA XXE SSRF via Custom Plugin Repos before 2022.3
CVE-2022-46827 5.5 - Medium - December 08, 2022

In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.

XXE

IntelliJ IDEA 2022.2 Path Traversal in Builtin Web Server
CVE-2022-46826 5.5 - Medium - December 08, 2022

In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability.

Directory traversal

IntelliJ IDEA 2022 web server info leakage before 2022.3
CVE-2022-46825 3.3 - Low - December 08, 2022

In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects.

Inadequate Encryption Strength

INTELLIJ IDEA Installer <2022.2.2: EXE Search Order Hijacking
CVE-2022-40978 7.8 - High - September 19, 2022

The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking

DLL preloading

IntelliJ IDEA < 2022.2 Email Validation Bypass via Git User Name Prompt
CVE-2022-37010 3.3 - Low - July 28, 2022

In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed

Improper Input Validation

Local Exec in IntelliJ IDEA < 2022.2 via Vagrant EXe
CVE-2022-37009 7.8 - High - July 28, 2022

In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible

Code Injection

In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient
CVE-2022-29812 2.3 - Low - April 28, 2022

In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient

In JetBrains IntelliJ IDEA before 2022.1 local code execution
CVE-2022-29813 6.7 - Medium - April 28, 2022

In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible

Code Injection

In JetBrains IntelliJ IDEA before 2022.1 local code execution
CVE-2022-29814 7.7 - High - April 28, 2022

In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible

Code Injection