EUVD-2026-33415
GHSA-gjhj-r92c-v3ff
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires a low-privileged guest account (PR:L) over a network-reachable collaborative session (AV:N/AC:L); command execution yields full host compromise, so C/I/A all High, scope unchanged.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account
AnalysisAI
Command execution in JetBrains IntelliJ IDEA before 2026.1.1 allows a holder of the low-privileged guest user account to run operating-system commands it should not be authorized to invoke, effectively bypassing intended authorization boundaries. The flaw carries a CVSS 8.8 rating with total technical impact, but there is no public exploit identified at time of analysis and the EPSS probability is 0.00%, indicating no observed or predicted mass exploitation. It was reported by JetBrains and is fixed in 2026.1.1.
Technical ContextAI
IntelliJ IDEA is JetBrains' flagship Java/Kotlin integrated development environment, widely used on developer workstations and, increasingly, in shared or collaborative modes that expose a lower-privileged 'guest' account (for example collaborative editing or remote-development sessions). The root cause is classified as CWE-862 (Missing Authorization): the guest account is granted the ability to trigger command execution without the authorization check that should gate that capability. Because the IDE routinely orchestrates build tools, run configurations, and shell processes, an authorization gap around the guest role can translate directly into arbitrary OS command execution in the context of the host user. The single affected CPE is cpe:2.3:a:jetbrains:intellij_idea:*, covering all builds prior to 2026.1.1.
RemediationAI
Upgrade to IntelliJ IDEA 2026.1.1 or later, which JetBrains has released as the fix (Vendor-released patch: 2026.1.1); consult the vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for the precise build. Until the update is applied, the most direct compensating control is to disable or avoid guest-accessible collaboration/remote features (for example Code With Me or shared sessions) so no untrusted party holds the guest account - the trade-off is loss of collaborative editing. Additionally restrict who can be invited as a guest to trusted individuals only and run the IDE under a least-privileged OS user to limit the blast radius of any command execution, accepting that this does not remove the underlying authorization gap. Reference records: https://nvd.nist.gov/vuln/detail/CVE-2026-49367 and https://vuldb.com/vuln/367350 .
More in Intellij Idea
View allUnauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration with
Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers
Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper
Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by con
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin
In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. Rated
In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartex
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to s
In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote att
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin,
Unauthorized file access in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to read files they should not
Local code execution on Remote Development hosts is possible in JetBrains IntelliJ IDEA versions before 2026.2.2 due to
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today