IntelliJ IDEA EUVD-2026-26368

Exploitation requires the IntelliJ IDEA built-in web server to be actively running, which occurs automatically when using features like JavaScript debugging, live edit, or serving static content during development. The victim developer must be tricked into visiting an attacker-controlled webpage or clicking a malicious link while the IDE is open with the web server enabled (UI:R requirement). The attack targets localhost network interface by default but can affect networked configurations if developers bind the web server to 0.0.0.0 for remote debugging. The vulnerability does not require authenticated access (PR:N) to the web server itself, meaning any web content able to send cross-origin requests to localhost can attempt exploitation. Exploitation is limited to the time window when both IntelliJ IDEA is running with web server features active AND the developer interacts with attacker-controlled content via browser. Developers using IntelliJ purely for non-web development without enabling preview/debugging features are not affected.

Real-world risk is moderate despite the 7.4 CVSS score. Attack vector is network-based (AV:N) with low complexity (AC:L) and no authentication required (PR:N), but mandatory user interaction (UI:R) significantly constrains exploitation-attackers must socially engineer developers into visiting a malicious URL while IntelliJ IDEA's web server is active. The scope change (S:C) elevates severity by enabling access to files beyond the web server context, potentially exposing source code, credentials, SSH keys, or configuration files from the developer's machine. EPSS data not provided, but absence from CISA KEV and lack of public POC suggest limited widespread exploitation. However, targeted attacks against software development organizations represent realistic threat scenarios, as developer workstations contain high-value intellectual property. The information disclosure-only impact (C:H/I:N/A:N) limits damage to confidentiality breaches without system compromise. Priority should focus on development teams using IntelliJ IDEA's built-in server in networked environments or those accessible via browser-based attacks. Home/isolated development environments face lower risk than corporate networks where lateral movement enables attacker access to developer browsers.

An attacker identifies a developer using vulnerable IntelliJ IDEA with the built-in web server active (default port 63342). Through phishing or watering hole attack, the attacker tricks the developer into visiting a malicious website containing JavaScript that sends crafted HTTP requests to http://localhost:63342 exploiting path traversal or symlink vulnerabilities. The web server improperly resolves file paths, allowing the attacker to read arbitrary files such as ~/.ssh/id_rsa, environment files containing API keys, or proprietary source code from the developer's filesystem. No public POC exists at time of analysis, but the UI:R vector confirms social engineering is the required initial access method.