IntelliJ IDEA CVE-2026-75056

Exploitation requires that the target user is running an unpatched version of JetBrains IntelliJ IDEA (before 2026.2.1) on their local workstation. The attacker must successfully deliver a specially crafted Markdown file to the victim - through a repository clone, email attachment, shared document, or similar means. The victim must then actively invoke the Markdown export tool on that file within IntelliJ IDEA (UI:R). Exploitation is limited to the local machine context; it cannot be triggered remotely without the file delivery and user-interaction steps. There is no indication from the CVSS vector or description that a non-default IntelliJ IDEA configuration is required - the Markdown export tool appears to be a standard feature.

The CVSS base score of 7.8 (High) is driven by full C/I/A impact once exploitation succeeds, but the vector AV:L/UI:R significantly constrains real-world reach - an attacker cannot exploit this remotely without first getting a crafted Markdown file onto a developer's workstation and inducing them to trigger an export. EPSS data is absent from the provided intelligence, so probabilistic exploitation likelihood cannot be quantified. KEV status is negative and no public POC has been identified, meaning this is currently a theoretical but credible threat rather than an active exploitation campaign. The PR:N metric is notable: no elevated system privileges are required, meaning any developer running an unpatched IntelliJ IDEA instance is exposed upon opening a malicious file. The primary real-world risk vector is supply chain or social engineering - a malicious repository, code review attachment, or documentation file. Development environments typically run with broad user-level access and often store credentials, making code execution on a developer workstation a high-value outcome for attackers despite the local-access constraint.

A threat actor embeds OS command injection payloads within a specially crafted Markdown file and delivers it to a target developer via a malicious pull request, shared documentation link, or phishing attachment. The developer opens the file in IntelliJ IDEA and invokes the Markdown export function, triggering unsanitized command execution. The injected command runs with the privileges of the IntelliJ IDEA process, allowing credential theft, persistence installation, or lateral movement from the developer workstation.