IntelliJ IDEA CVE-2026-86505

Exploitation requires the victim to locally open an attacker-supplied or untrusted IntelliJ IDEA project in a version prior to 2026.2.2; this is the triggering condition for the missing trust check. The project file must be present on the local filesystem (AV:L), and the user must actively open it within the IDE (UI:R). The metadata is transmitted to JetBrains Marketplace (a JetBrains-controlled endpoint), not to an arbitrary attacker server, which limits the direct attacker benefit. Exploitation is bounded by: (1) the social engineering step required to deliver the project, (2) the necessity of user interaction, and (3) the fact that exfiltrated data reaches JetBrains infrastructure rather than the attacker directly. No authentication bypass or network-reachable attack surface is involved.

CVSS 3.3 (Low) accurately reflects the limited real-world risk of this vulnerability. The attack vector is local (AV:L), requiring the victim to open an attacker-crafted project file, which necessitates social engineering and explicit user interaction (UI:R). The confidentiality impact is constrained to project metadata (C:L) - not source code, credentials, or secrets - transmitted to JetBrains' own Marketplace infrastructure rather than to an arbitrary attacker-controlled endpoint. There is no integrity or availability impact. No EPSS data was provided, and no KEV listing or public exploit exists, further supporting a low-priority assessment. The primary concern is a privacy violation affecting developers who open untrusted projects, rather than a remotely exploitable attack surface. The CVSS PR:N metric is technically accurate (the attacker who crafted the project needs no privileges on the victim machine) but may overstate perceived risk given the social-engineering prerequisite.

An attacker crafts a specially structured IntelliJ IDEA project and distributes it to a target developer via a code-sharing platform, email, or repository link. When the developer opens the project in an unpatched version of IntelliJ IDEA, the missing project-trust check causes project metadata to be silently transmitted to JetBrains Marketplace infrastructure. No public exploit code exists for this vulnerability.