EUVD-2026-48235
GHSA-3rwj-4395-cj7h
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network delivery with no attacker authentication required; user must view notification (UI:R); impact is confidentiality-only via silent activity tracking with no integrity or availability consequence.
Primary rating from Vendor (jetbrains).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking
AnalysisAI
HTML injection in JetBrains IntelliJ IDEA before version 2026.2 enables silent user activity tracking through maliciously crafted IDE notifications. A remote attacker who can influence notification content - such as through a malicious plugin, crafted project file, or server response reflected as a notification - can inject arbitrary HTML payloads that silently load remote resources, beaconing user activity without any visible indication to the developer. No public exploit has been identified at time of analysis, and the CVSS 4.3 Medium score reflects a limited confidentiality-only impact with no integrity or availability consequence.
Technical ContextAI
The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), applied specifically to IntelliJ IDEA's internal notification rendering subsystem. JetBrains IDEs display rich notifications within the IDE interface; if notification content sourced from external inputs (plugins, repository data, remote server responses) is not properly sanitized before rendering, an attacker can embed HTML elements such as remote-src image tags that silently issue outbound HTTP requests. The CVSS vector AV:N confirms the injection vector is network-reachable rather than purely local. No CPE strings were supplied in the source intelligence, but the affected product is confirmed as JetBrains IntelliJ IDEA across all editions prior to 2026.2.
RemediationAI
Upgrade JetBrains IntelliJ IDEA to version 2026.2 or later, which contains the vendor-released patch per the advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. If immediate upgrade is not feasible, apply host-based firewall rules to restrict outbound HTTP/HTTPS connections from the IntelliJ IDEA process to only known, trusted endpoints - this prevents injected HTML payloads from beaconing to attacker-controlled servers, though it may interfere with legitimate IDE plugin and update functionality. Additionally, audit installed plugins for untrusted or unverified sources and avoid opening projects cloned from untrusted repositories until the patch is applied.
More in Intellij Idea
View allUnauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration with
Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers
Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper
Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by con
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin
In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. Rated
In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartex
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to s
In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote att
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin,
Command execution in JetBrains IntelliJ IDEA before 2026.1.1 allows a holder of the low-privileged guest user account to
Unauthorized file access in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to read files they should not
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today