EUVD-2026-60254
GHSA-pv7f-2fc9-p5x3
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Local file read via XXE requires opening a crafted file (UI:R, AV:L); no authentication needed; confidentiality impact is high, no integrity or availability effect.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE
AnalysisAI
Local file disclosure in JetBrains IntelliJ IDEA before 2026.2.1 is possible through an XXE injection in the Hadoop ResourceManager integration component. When a developer opens or processes a maliciously crafted XML-based project or configuration file, the unsanitized XML parser resolves external entity references and leaks arbitrary local files - including SSH keys, credentials, and application secrets - to the attacker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector AV:L confirms the attack is local - the malicious XML file must be present on the developer's local filesystem. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 base score of 5.5 (Medium) reflects the local attack vector (AV:L) and required user interaction (UI:R), which substantially constrain exploitability despite the high confidentiality impact (C:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious Hadoop ResourceManager XML configuration file containing an external entity declaration pointing to a sensitive local path such as '~/.ssh/id_rsa' or application credential files. The file is delivered to a target developer via a shared repository, email, or compromised package, and when the developer opens the project in IntelliJ IDEA (before 2026.2.1) the Hadoop plugin parses the XML, resolves the external entity, and the file contents are read - potentially exfiltrated via an OOB channel embedded in the XXE payload. … |
| Remediation | Upgrade JetBrains IntelliJ IDEA to version 2026.2.1 or later, which is the vendor-confirmed fix version per the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today