IntelliJ IDEA EUVD-2026-72517

Exploitation requires local filesystem access to the directory containing idea.log, with at least low-privilege read rights to that file (AV:L/PR:L). The victim (UI:R) must actively type terminal commands containing sensitive data - such as passwords, API tokens, or private keys - as command-line arguments within IntelliJ IDEA's integrated terminal. The vulnerability is inert if the user does not pass sensitive strings through the terminal interface, and it has no network exposure whatsoever. Exploitation is further limited by the fact that idea.log is written to a user-scoped directory, which on single-user machines or properly permission-restricted systems is not accessible to other OS accounts. Log-aggregation or CI artifact collection pipelines that scrape the JetBrains log directory represent the broadest realistic exposure vector beyond direct local access.

Real-world risk is low. The CVSS 2.8 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) constrains exploitation to a local attacker who already has read access to idea.log, while requiring the victim to actively type sensitive strings in the terminal (UI:R). No KEV listing and no known POC code have been identified, placing this in the lowest exploitation-likelihood tier. The primary realistic risk is on shared developer workstations, CI/CD build agents where idea.log might be collected as an artifact, or centralized log-aggregation setups where the file's contents flow to a less-restricted system. For individual developers running IntelliJ on a personal machine with no co-located threat actors, risk is negligible. EPSS data was not provided; given the local-only vector and low CVSS, the score is expected to be very low.

A local attacker or a process with read access to the idea.log file on a shared developer workstation waits for a developer to use IntelliJ IDEA's integrated terminal to run commands that include sensitive strings - for example, a curl command with a Bearer token or a database CLI invocation with a password flag. After the IDE session, the attacker reads idea.log and extracts the logged command text to harvest the credentials. No public exploit code exists for this vulnerability.