EUVD-2026-60257
GHSA-4qhh-vhvg-gc9c
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file import required (AV:L), user must actively trigger the Eclipse import (UI:R), no attacker privileges needed (PR:N), and XXE yields arbitrary file read but no write or availability impact (C:H/I:N/A:N).
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
AnalysisAI
XML External Entity injection in JetBrains IntelliJ IDEA's Eclipse settings importer exposes sensitive local files on developer workstations running versions prior to 2026.2.1. The flaw (CWE-611) is triggered when a user imports a maliciously crafted Eclipse settings XML file, allowing an attacker to read arbitrary files accessible to the IDE process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be running JetBrains IntelliJ IDEA prior to version 2026.2.1 and to actively invoke the Eclipse settings importer feature with a malicious XML file present on the local filesystem (AV:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.5 Medium score accurately reflects the constrained attack surface: AV:L (the malicious file must be local or reachable from the local filesystem), AC:L (no special configuration beyond the import action), and UI:R (the user must actively invoke the Eclipse importer) together significantly limit opportunistic exploitation compared to network-accessible XXE vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious Eclipse settings XML file with a DOCTYPE external entity pointing to a high-value local file (e.g., ~/.ssh/id_rsa or a local .env containing API keys) and distributes it through a shared team repository, an open-source project contribution, or a direct social engineering approach. A developer on an unpatched IntelliJ IDEA installation imports the file via the Eclipse importer, and the IDE's XML parser resolves the external entity reference, exposing the targeted file's contents. … |
| Remediation | Vendor-released patch: IntelliJ IDEA 2026.2.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today