EUVD-2026-48240
GHSA-r2fm-vv3h-4qf2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 28, 2026
Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by convincing a developer to open a malicious UI Designer form file, leading to full system compromise. No active exploitation or public exploit code has been reported, but a critical-severity vendor patch is available.
Earlier versions of this analysis (1)
Arbitrary code injection in JetBrains IntelliJ IDEA before 2026.2 allows attacker-controlled UI Designer form (.form) files to execute code within the IDE process when a developer opens or builds the containing project. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CWE-94 code-injection class combined with the IDE's broad developer footprint makes this a meaningful developer-workstation compromise vector. The vendor-assigned CVSS of 8.1 reflects High/High/High impact, though the network attack vector is delivered through malicious project content rather than a listening service.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Intellij Idea gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Malicious form files travel via cloned projects (AV:N) but require the developer to open/build the project (UI:R); the exploit itself is reliable once opened (AC:L), yielding full C/I/A impact at user privilege.
Primary rating from Vendor (jetbrains).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
Executive ViewAI
JetBrains IntelliJ IDEA versions before 2026.2 contain an arbitrary code injection vulnerability in UI Designer form (.form) files that executes code within the IDE process when developers open malicious projects. With no vendor-released patch identified at time of analysis, this poses urgent risk to developer workstations: potential source code theft, credential exposure, and supply chain contamination. Organizations with active development teams require immediate containment measures and close monitoring of vendor security advisories.
Within 24 hours, issue a security advisory to all development teams restricting the opening of untrusted project repositories in IntelliJ IDEA until patching is available. Within 7 days, audit project repositories for suspicious .form file modifications, implement mandatory code review for all .form file changes, and consider disabling the UI Designer plugin if not actively required. Within 30 days, immediately deploy IntelliJ IDEA 2026.2 or later to all developer workstations upon release by JetBrains, and maintain monitoring of vendor security advisories for patch deployment confirmation.
Restrict opening of untrusted projects in IntelliJ IDEA; disable UI Designer plugin if unused; implement mandatory code review for .form file changes; monitor repositories for anomalous .form file modifications; isolate development workstations from critical production network segments pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Intellij Idea
View allUnauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration with
Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers
Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper
In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin
In JetBrains IntelliJ IDEA before 2020.1, the license server could be resolved to an untrusted host in some cases. Rated
In several versions of JetBrains IntelliJ IDEA Ultimate, creating Task Servers configurations leads to saving a cleartex
In several JetBrains IntelliJ IDEA versions, creating remote run configurations of JavaEE application servers leads to s
In several JetBrains IntelliJ IDEA versions, a Spring Boot run configuration with the default setting allowed remote att
In several JetBrains IntelliJ IDEA Ultimate versions, an Application Server run configuration (for Tomcat, Jetty, Resin,
JetBrains Toolbox App and IntelliJ IDEA expose a certificate-validation weakness in the jetbrainsd daemon that can let a
Command execution in JetBrains IntelliJ IDEA before 2026.1.1 allows a holder of the low-privileged guest user account to
Unauthorized file access in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to read files they should not
Exploit-DB