IntelliJ IDEA EUVD-2026-60254

The CVSS vector AV:L confirms the attack is local - the malicious XML file must be present on the developer's local filesystem. UI:R confirms user interaction is required: the victim must actively open or process the crafted file within IntelliJ IDEA. The vulnerability is specific to the Hadoop ResourceManager integration component, so the plugin must be installed and the victim must interact with a Hadoop-related file or project. PR:N indicates no IntelliJ IDEA privileges are required beyond opening the file. Exploitation is limited by: (1) local or social-engineering delivery of a crafted XML file, (2) victim use of IntelliJ IDEA with the Hadoop plugin active, and (3) running a vulnerable version prior to 2026.2.1. Remote unauthenticated exploitation without user interaction is not possible given AV:L/UI:R.

The NVD CVSS 3.1 base score of 5.5 (Medium) reflects the local attack vector (AV:L) and required user interaction (UI:R), which substantially constrain exploitability despite the high confidentiality impact (C:H). The scope is unchanged (S:U) with no integrity or availability impact (I:N/A:N). No EPSS score was supplied in the input, no POC is reported, and the vulnerability is absent from CISA KEV - indicating no confirmed active exploitation. Real-world risk is therefore lower than the C:H metric alone suggests: an attacker must either have local access to the developer's machine or convince the developer to open a crafted file (supply-chain or spear-phishing scenario). For development environments handling sensitive credentials or cloud configuration, the residual risk is meaningful. CVSS signals and description are internally consistent; no conflicting data was detected.

An attacker crafts a malicious Hadoop ResourceManager XML configuration file containing an external entity declaration pointing to a sensitive local path such as '~/.ssh/id_rsa' or application credential files. The file is delivered to a target developer via a shared repository, email, or compromised package, and when the developer opens the project in IntelliJ IDEA (before 2026.2.1) the Hadoop plugin parses the XML, resolves the external entity, and the file contents are read - potentially exfiltrated via an OOB channel embedded in the XXE payload. No public POC has been reported, but XXE exploitation is a well-understood, low-complexity technique.