EUVD-2026-48236
GHSA-pjq3-x359-m2pf
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Trusted source inclusion only
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Arbitrary code execution in JetBrains IntelliJ IDEA before 2026.2 allows a malicious project to run attacker-controlled code before the user grants project trust, by abusing development container (dev container) configuration that the IDE processes prematurely. Any developer who opens or clones a crafted repository is affected, since code executes ahead of the trust prompt that is supposed to gate untrusted projects. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the local, low-complexity nature and RCE tagging make it a meaningful supply-chain-of-code risk.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Intellij Idea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (jetbrains) · only source for this CVE.
CVSS VectorVendor: jetbrains
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration
Executive ViewAI
JetBrains IntelliJ IDEA versions prior to 2026.2 execute malicious code embedded in projects before the IDE's trust verification prompt, creating direct supply-chain risk for any developer who opens untrusted or compromised repositories. Exploitation allows attackers to steal source code, credentials, and build infrastructure access under developer credentials.
Within 24 hours, inventory IntelliJ IDEA instances using versions prior to 2026.2 and notify affected developers; restrict opening untrusted repositories until compensating controls are deployed. Within 7 days, disable dev container auto-execution in IDE security settings organization-wide, require peer code review for externally sourced repositories, and restrict developer access to vetted internal repository sources only. Within 30 days, monitor JetBrains release channels for IntelliJ IDEA 2026.2 availability and plan a phased rollout; test the patched version with a pilot group before full deployment.
No vendor-released patch identified at time of analysis. Interim mitigations: disable dev container auto-loading in IDE settings; enforce mandatory code review before opening external repositories; restrict repository access to organization-controlled sources only; enable file-access auditing on developer machines; maintain audit logs of all project-open events; consider reverting to IDE versions pre-dating this vulnerability if 2026.2 release is significantly delayed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Intellij Idea
View allUnauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration with
Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers
Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper
Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by con
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin
In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. Rated
In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartex
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to s
In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote att
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin,
JetBrains Toolbox App and IntelliJ IDEA expose a certificate-validation weakness in the jetbrainsd daemon that can let a
Command execution in JetBrains IntelliJ IDEA before 2026.1.1 allows a holder of the low-privileged guest user account to
Exploit-DB