EUVD-2026-60251
GHSA-jx69-9f6w-q2xj
Severity by source
AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
AV:L because execution is local; AC:H reflects the trusted-project precondition; UI:R for mandatory Markdown preview interaction; C:L/I:L bounded to user-level command execution with no availability impact described.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects
AnalysisAI
Command injection in JetBrains IntelliJ IDEA before 2026.2.1 enables arbitrary command execution through crafted Markdown preview content when a user opens and trusts a malicious project. The flaw (CWE-77) is constrained to trusted projects and requires the victim to interact with the Markdown preview, limiting its practical reach. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions simultaneously: (1) the target must be running IntelliJ IDEA in a version before 2026.2.1 on any supported platform; (2) the malicious project must be opened and explicitly designated as a 'trusted project' within IntelliJ IDEA's project trust model - the IDE prompts users before trust is granted, so the victim must actively approve trust; (3) the victim must open or trigger the Markdown preview of the crafted file (UI:R), meaning passive project opening alone is insufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) scores 3.6 (Low), reflecting a local attack surface, high complexity, and mandatory user interaction - all of which meaningfully constrain real-world exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes or sends a malicious code repository containing a crafted Markdown file engineered to trigger command injection when rendered. The victim clones the repository, opens it in IntelliJ IDEA before 2026.2.1, grants it trusted-project status, and opens the crafted Markdown file - causing the IDE's preview renderer to execute attacker-controlled commands under the victim's user account. … |
| Remediation | Upgrade JetBrains IntelliJ IDEA to version 2026.2.1 or later, which contains the vendor-released fix for this command injection vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today