JetBrains IntelliJ IDEA CVE-2026-86504

Exploitation requires: (1) the victim is running JetBrains IntelliJ IDEA prior to version 2026.2.2 with Dev Container support available; (2) the victim opens or clones a project that contains a malicious .devcontainer/devcontainer.json - this is the single user interaction (UI:R) required; (3) the IDE proceeds to build the Dev Container, which it does without the missing trust-confirmation gate. The attacker requires no authentication or elevated privileges (PR:N). Exploitation is constrained to local execution on the victim's machine - the attacker cannot remotely trigger the container build; social engineering or supply chain compromise of a dependency/repository is the expected delivery vector. Developers who manually inspect project configuration files before building, or who never open externally supplied projects, are not susceptible.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately captures the attack profile: local delivery requiring one act of user interaction, but full host compromise once triggered. The local attack vector reflects that the malicious project must first reach the developer's filesystem - typically via a cloned repository, email attachment, or shared archive - so purely remote, zero-interaction exploitation is not possible. Low attack complexity and no required privileges mean any developer who opens a crafted project is immediately at risk with no further steps. EPSS data was not provided, and there is no CISA KEV listing and no public exploit identified at time of analysis, which reduces the near-term automated exploitation risk. That said, even a mid-sized municipal IT team in mielec relying on IntelliJ IDEA for development would be well-advised to treat this as urgent, since the real-world blast radius extends well beyond the affected workstation: developer machines typically hold SSH keys, cloud credentials, signing certificates, and direct access to internal CI/CD pipelines, dramatically amplifying the consequence of host-level code execution. The S:U scope designation may therefore understate the organizational risk.

An attacker publishes a public repository containing a .devcontainer/devcontainer.json that runs a credential-harvesting or reverse-shell script during container initialization. A developer clones the repository and opens it in a vulnerable IntelliJ IDEA installation; without a trust prompt, the IDE immediately triggers the Dev Container build, executing the embedded payload on the developer's host with that user's full OS-level privileges. The attacker gains access to the developer's SSH keys, cloud tokens, and any secrets stored in the IDE or on the local filesystem.