IntelliJ IDEA EUVD-2026-42910

Exploitation targets the project workspace ID handling routine, so the concrete prerequisite is that a vulnerable IntelliJ IDEA (before 2026.1.4, or 2026.2) loads a project carrying an attacker-controlled workspace ID with path-traversal content. The most likely limiting factor is user interaction: the victim must open, import, or otherwise trust the malicious project, meaning delivery depends on social engineering (shared repo, downloaded sample, or malicious template) rather than direct network reachability. Note the tension with the published vector: NVD lists PR:N/UI:N (no interaction), but the described code path implies a project must be loaded - treat 'no user interaction' as unconfirmed pending vendor clarification.

The published CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) implies fully remote, unauthenticated, no-interaction RCE, but this conflicts with the description, which points to project workspace ID handling - a code path exercised when a project is loaded into the IDE. That strongly implies a victim must open or import an attacker-supplied project, i.e. UI:R and likely AV:L (file-borne) rather than AV:N/UI:N - verify with the vendor before treating this as wormable network RCE. EPSS is not provided, the vulnerability is not in CISA KEV (no confirmed active exploitation), and no public exploit has been identified, so real-world exploitation currently appears theoretical and social-engineering dependent rather than mass-exploitable. Net: patch promptly because the technical impact (code execution) is severe and IntelliJ is ubiquitous among developers, but the effective risk is lower than the 9.8 headline suggests since it most plausibly requires opening a malicious project.

An attacker crafts a project (shared via a repository, ZIP, or sample template) whose workspace ID contains traversal sequences; when a developer opens it in a vulnerable IntelliJ IDEA, the IDE resolves the ID outside the workspace and writes to an attacker-controlled path, dropping or overwriting a file that leads to code execution in the developer's context. No public exploit is known, and the low CVSS attack complexity suggests reliable triggering once a victim opens the crafted project.