IntelliJ IDEA CVE-2026-75058

Exploitation requires the victim to be running JetBrains IntelliJ IDEA prior to version 2026.2.1 and to actively invoke the Eclipse settings importer feature with a malicious XML file present on the local filesystem (AV:L). User interaction is mandatory (UI:R) - the developer must explicitly trigger the import action; passive or drive-by exploitation is not possible. No attacker privileges are required (PR:N), but the attacker must deliver the malicious file and persuade the user to import it, adding a social engineering dependency. Exploitation is bounded to confidentiality only: arbitrary local file read scoped to files accessible by the IntelliJ IDEA process (C:H), with no write capability (I:N) and no availability impact (A:N). Non-default use of the Eclipse importer (it is an optional migration feature, not invoked during normal IDE operation) further limits the exposed population to developers actively migrating from Eclipse.

The CVSS 5.5 Medium score accurately reflects the constrained attack surface: AV:L (the malicious file must be local or reachable from the local filesystem), AC:L (no special configuration beyond the import action), and UI:R (the user must actively invoke the Eclipse importer) together significantly limit opportunistic exploitation compared to network-accessible XXE vulnerabilities. The C:H impact rating is the most significant signal - developer workstations frequently store SSH private keys, API tokens, database credentials, and proprietary source code, making local file exfiltration disproportionately damaging relative to the moderate score. No EPSS data was provided, so exploitation probability cannot be quantitatively assessed; the absence from CISA KEV and lack of any identified public exploit code suggest this has not been observed in active campaigns at time of analysis. The primary realistic threat is a supply-chain or social-engineering scenario targeting developers who import shared project configurations from third-party or compromised repositories. The social engineering prerequisite is a genuine limiting factor but not a reliable long-term defense given how routinely developers exchange IDE settings files.

An attacker crafts a malicious Eclipse settings XML file with a DOCTYPE external entity pointing to a high-value local file (e.g., ~/.ssh/id_rsa or a local .env containing API keys) and distributes it through a shared team repository, an open-source project contribution, or a direct social engineering approach. A developer on an unpatched IntelliJ IDEA installation imports the file via the Eclipse importer, and the IDE's XML parser resolves the external entity reference, exposing the targeted file's contents. No public exploit code has been identified, but the XXE technique for CWE-611 is thoroughly documented and trivially reproducible from public references.