IntelliJ IDEA CVE-2026-49382

Exploitation requires the victim to be running IntelliJ IDEA before 2026.1 and to open or process content that causes the Copyright plugin's template engine to evaluate an attacker-supplied copyright template expression - for example opening/importing a project or copyright profile carrying the injected template. Limiting factors are significant: the CVSS vector is AV:L (local, not remotely reachable) and UI:R (the developer must take an action such as opening the malicious project or triggering copyright-header generation), and the Copyright plugin must be enabled and its template evaluated. There is no unauthenticated network exploitation path; execution occurs only with the victim's local privileges after their interaction.

The signals are internally consistent and point to a real but non-urgent priority. The CVSS base score of 7.8 (High) is driven by full C/I/A impact once triggered, but the vector requires local access and user interaction (AV:L/UI:R), meaning a victim must open a crafted project or profile rather than being attacked over the network. This aligns with SSVC (exploitation: none, automatable: no, technical impact: partial) and an EPSS of 0.00%, indicating no observed exploitation and no ease of mass automation. It is not KEV-listed and no public exploit is identified, so this is a patch-in-normal-cycle item for developer endpoints rather than an emergency; the primary residual risk is supply-chain-style abuse where a developer is lured into opening a malicious repository containing a weaponized Copyright profile.

An attacker publishes or shares a repository containing a malicious IntelliJ Copyright profile with a template payload; when a developer clones and opens the project and the copyright template is evaluated, arbitrary code runs under the developer's account. No public proof-of-concept is available, and the local vector with required user interaction means the attack depends on social engineering the victim into opening the crafted project.