What is the CVSS score of CVE-2026-49366?

CVE-2026-49366 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of JetBrains IntelliJ IDEA are affected by CVE-2026-49366?

JetBrains IntelliJ IDEA versions before 2026.1.1 contain a command injection vulnerability in the filename completion feature that could allow attackers to execute arbitrary code on developer…. A patch is available.

How to fix or mitigate CVE-2026-49366?

Within 24 hours: Audit all deployed IntelliJ IDEA versions and identify instances below 2026.1.1. Within 7 days: Instruct developers to avoid opening files from untrusted sources; disable filename completion in Settings > Editor > General > Code Completion where practical; implement monitoring for unusual process execution on development workstations. Within 30 days: Establish timeline for upgrade to IntelliJ IDEA 2026.1.1 or later and deploy endpoint detection capabilities to identify exploitation attempts.

JetBrains IntelliJ IDEA CVE-2026-49366

EUVD-2026-33414 HIGH

OS Command Injection (CWE-78)

2026-05-29 JetBrains

GHSA-rc87-jvvm-wgq4

Command Injection Intellij Idea

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 29, 2026 - 20:02 EUVD

Analysis Generated

May 29, 2026 - 18:53 vuln.today

DescriptionCVE.org

In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion

AnalysisAI

Command injection in JetBrains IntelliJ IDEA before 2026.1.1 allows attackers to execute arbitrary OS commands by abusing the filename completion feature when a developer interacts with a crafted filename. The flaw is locally exploitable with user interaction required and has high impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

IntelliJ IDEA is JetBrains' flagship Java/Kotlin integrated development environment, widely used across enterprise software development. The root cause is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning that filenames offered or selected through the IDE's filename completion logic are passed into an OS command construction path without proper sanitization or quoting. When a developer triggers completion on a file whose name contains shell metacharacters, those characters break out of the intended argument boundary and are interpreted as additional commands by the underlying shell or process executor. The affected component is identified by CPE cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:* covering all IntelliJ IDEA versions prior to the fixed release 2026.1.1.

RemediationAI

Vendor-released patch: upgrade IntelliJ IDEA to 2026.1.1 or later, which is the primary and recommended remediation per JetBrains' fixed-issues page at https://www.jetbrains.com/privacy-security/issues-fixed/. Until the upgrade can be deployed, compensating controls include avoiding use of filename completion in directories that contain untrusted content, refusing to open or browse repositories and archives from unverified sources, and instructing developers to clone third-party projects into sandboxed VMs or containers where shell execution from the IDE is isolated; the trade-off is reduced developer productivity and reliance on user discipline rather than technical enforcement. Endpoint detection rules can also be tuned to alert on unexpected shell child processes spawned by the IntelliJ IDEA process, accepting some false-positive noise from legitimate build tooling.