What is the CVSS score of CVE-2026-49382?

CVE-2026-49382 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of IntelliJ IDEA are affected by CVE-2026-49382?

A code execution vulnerability in JetBrains IntelliJ IDEA (CVE-2026-49382) affects developer machines when a malicious project is opened, potentially granting attackers access to source code…. A patch is available.

How to fix or mitigate CVE-2026-49382?

Within 24 hours, identify all IntelliJ IDEA installations across engineering teams and communicate the vulnerability with guidance to avoid opening untrusted project files; simultaneously, prepare upgrade paths to version 2026.1 or later. Within 7 days, begin staged deployment of version 2026.1 starting with critical development machines and those with elevated repository access. Complete organization-wide upgrade to version 2026.1 or later within 30 days.

IntelliJ IDEA CVE-2026-49382

EUVD-2026-33390 HIGH

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-05-29 JetBrains

GHSA-fwch-gx6q-xhxg

Ssti RCE Intellij Idea

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

SSTI runs code locally after a user opens a crafted project, so AV:L and UI:R; no prior privileges needed (PR:N) and full code execution yields C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 06:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 06:22 vuln.today

cvss_changed

Severity Changed

Jul 22, 2026 - 06:22 NVD

MEDIUM HIGH

CVSS changed

Jul 22, 2026 - 06:22 NVD

4.5 (MEDIUM) 7.8 (HIGH)

Patch available

May 29, 2026 - 20:02 EUVD

Analysis Generated

May 29, 2026 - 18:56 vuln.today

DescriptionNVD

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin

AnalysisAI

Code execution in JetBrains IntelliJ IDEA prior to 2026.1 is achievable through server-side template injection (SSTI) in the built-in Copyright plugin, which lets an attacker embed executable template expressions into copyright profile configurations. Because the CVSS vector is local with required user interaction (AV:L/UI:R), exploitation hinges on a developer opening or importing a malicious project/profile that triggers the injected template, running with the victim's privileges. There is no public exploit identified at time of analysis and EPSS is 0.00%, consistent with the SSVC 'exploitation: none' assessment.

Technical ContextAI

IntelliJ IDEA's Copyright plugin lets users define copyright notice profiles using a template/expression language (velocity-style scripting) that is evaluated to render dynamic copyright headers into source files. CWE-1336 (improper neutralization of special elements used in a template engine, i.e., SSTI) indicates that attacker-controlled template content is passed to the template engine without sufficient sandboxing, so directives that reach out to Java runtime objects can execute arbitrary code within the IDE process. The single affected CPE is cpe:2.3:a:jetbrains:intellij_idea:*, and the tags (SSTI, RCE) confirm the class is template-injection-driven remote/arbitrary code execution constrained to the IDE's local execution context.

RemediationAI

Vendor-released patch: upgrade IntelliJ IDEA to 2026.1 or later, the first release where the Copyright plugin template injection is fixed, as documented at https://www.jetbrains.com/privacy-security/issues-fixed/. Until the update is deployed, reduce exposure by not opening or importing untrusted projects and, where feasible, avoiding importing third-party copyright profiles; treat repository-supplied .idea/copyright configurations as untrusted and review them before opening, since the injected template executes when the profile is evaluated. If the Copyright plugin is not needed for a given workflow, disabling it removes the vulnerable code path at the cost of losing automated copyright-header insertion. Confirm patched versions via the vendor page and cross-check the EUVD/NVD advisories above.