JetBrains
Monthly
Host-level code execution in JetBrains IntelliJ IDEA before 2026.2.2 is triggered when a developer opens a malicious project containing a crafted Dev Container configuration, which the IDE proceeds to build without first requesting the standard project-trust confirmation. The flaw (CWE-829) allows untrusted, project-defined container build scripts and Docker commands to execute directly on the developer's host machine, bypassing the IDE's safety gate. JetBrains confirmed the issue and released a fix in version 2026.2.2; no public exploit has been identified at time of analysis.
Local code execution on Remote Development hosts is possible in JetBrains IntelliJ IDEA versions before 2026.2.2 due to the IJent gRPC server running without TLS encryption or any authentication mechanism. The IJent agent, deployed on remote hosts when the Remote Development feature is in use, accepts connections from any local process without requiring credentials, enabling arbitrary command execution under the agent's security context. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Incorrect authorization in JetBrains YouTrack before versions 2025.3.160480 and 2026.1.14047 allows authenticated low-privilege users to modify linked issue entities they lack update permission on by issuing PUT requests directly to link sub-resources. The flaw bypasses YouTrack's permission model at the HTTP method level, enabling integrity violations across project boundaries-reflected in the CVSS scope change (S:C). No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized integrity modification in JetBrains YouTrack before 2026.2.18634 allows any authenticated low-privilege user to alter links on issues they are explicitly prohibited from accessing by exploiting the whiteboard clone operation. The whiteboard clone workflow fails to validate the cloning user's authorization against issues referenced in the board, enabling cross-boundary write access governed by CWE-862 (Missing Authorization). No public exploit has been identified at time of analysis, but the CVSS 7.7 vector (S:C, I:H, PR:L, AC:L) accurately reflects the low barrier to exploitation and the cross-domain integrity impact.
Cross-tenant GitHub App installation token theft in JetBrains YouTrack before 2026.2.18634 lets any authenticated user retrieve GitHub App installation tokens belonging to other tenants due to a shared, non-isolated token cache. The root cause is CWE-488 (Exposure of Data Element to Wrong Session): cached tokens were keyed without tenant-scope isolation. With a stolen installation token, an attacker can authenticate to the GitHub API as the victim organization's GitHub App, gaining access to that organization's repositories, pull requests, issues, and CI/CD integrations; no public exploit has been identified at time of analysis.
Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alter group memberships without proper server-side authorization validation, effectively granting themselves elevated rights. The flaw (CWE-266, Incorrect Privilege Assignment) means the application trusts client-supplied group membership parameters without enforcing that the requesting user has the authority to make such changes. With a CVSS base score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields the equivalent of full administrative control over the YouTrack instance.
Privilege escalation to superuser in JetBrains Hub before 2026.2.52442 allows an unauthenticated remote attacker to register a trusted service and thereby obtain full administrative (superuser) control over the identity-management server. Because Hub is the single sign-on and authorization backbone for JetBrains tooling (YouTrack, TeamCity, Upsource), compromise cascades to every application relying on it for authentication. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Missing authorization in JetBrains YouTrack's REST API allows authenticated low-privileged users to access and modify restricted resources via Insecure Direct Object Reference (IDOR). Affected versions span all YouTrack releases prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 across three active release branches. An attacker with any valid account can enumerate or directly reference object identifiers in REST API calls to read or write data they should not have access to, with high confidentiality and integrity impact per the CVSS vector.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing accounts by asserting a victim's email address without proving ownership of it. All YouTrack builds before 2025.3.161254 and 2026.1.14042 are affected. Because the flaw is a trust failure in how Helpdesk associates a self-provided email with an account, exploitation requires no credentials, no user interaction, and works against default configurations where Helpdesk is enabled. No public exploit identified at time of analysis.
Code execution in JetBrains PyCharm before 2026.2.1 is possible through Jupyter MCP (Model Context Protocol) tools that expose critical functions without authentication. The root cause is CWE-306 (Missing Authentication for Critical Function) - the MCP tool surface in PyCharm's Jupyter integration fails to enforce any authentication check before executing code. Any local attacker able to reach the MCP endpoint can trigger arbitrary code execution with the privileges of the running PyCharm process, achieving full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis.
Remote code execution in JetBrains IntelliJ IDEA before version 2026.2.1 is achievable through the Markdown export tool via OS command injection. An attacker who can deliver a crafted Markdown file to a developer and induce them to export it can execute arbitrary operating system commands in the context of the IntelliJ IDEA process. No public exploit or CISA KEV listing has been identified at time of analysis, but the CWE-78 root cause and full C/H/I/H/A:H impact make this a meaningful risk for development workstation environments.
Unauthorized project transfer between organizations in JetBrains YouTrack before version 2026.2.17917 exposes high-severity access control failure affecting any multi-tenant or multi-organization deployment. Any authenticated low-privileged user can transfer projects across organizational boundaries without holding the necessary authorization, resulting in high confidentiality and integrity impact against affected projects and their data. No public exploit or CISA KEV listing is identified at time of analysis, but the low attack complexity and authentication-only requirement make this straightforwardly exploitable by any active YouTrack user.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.18068 allows remote attackers to persist malicious script payloads via the language label field of fenced code blocks in issues or comments. When any authenticated user views the affected content, the injected script executes within the YouTrack application origin - a scope change that enables session token theft, credential harvesting, or unauthorized actions on behalf of the victim (CVSS C:H). No public exploit code has been identified at time of analysis, but the low-complexity network vector makes this straightforward to weaponize once a reporter or contributor role is obtained.
Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 allows a remote attacker to abuse a shared draft signature to download full database backups without any credentials. Because backups typically contain issue data, user records, and secrets, this is a high-impact confidentiality exposure. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.1 rating and trivial network exploitability make it a priority patch.
Missing authorization on the mailbox endpoint in JetBrains YouTrack enables any authenticated user to delete arbitrary entities across the platform, regardless of ownership or role. Affected versions span three active release branches: all releases prior to 2025.3.156085, 2026.1.13914, and 2026.2.18095. The CVSS 3.1 score of 8.1 (High) reflects high integrity and availability impact with a low-privilege authentication bar; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute arbitrary code via deserialization of untrusted data in the agent polling protocol. The vulnerability carries a CVSS 9.8 score and poses immediate risk to any exposed TeamCity instance. No public exploit or active exploitation has been confirmed at the time of analysis.
Code execution in JetBrains TeamCity (before 2026.1.2 and 2025.11.6) allows a privileged user to run arbitrary code through Git VCS root configuration, mapping to CWE-94 code injection. The CVSS 3.1 score of 9.1 reflects a scope-changing flaw (S:C) that requires high privileges (PR:H) but no user interaction, meaning an attacker with rights to configure VCS roots can escalate into code execution on the CI/CD infrastructure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by JetBrains.
Arbitrary code execution in JetBrains PyCharm before 2026.1.4 and 2026.2 lets an attacker who supplies a crafted project achieve code execution when a victim opens that untrusted project in the IDE. PyCharm auto-selects or trusts a Python executable bundled or referenced by the project, so merely opening the malicious project runs attacker-controlled code with the user's privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the reporter is JetBrains itself and a vendor patch is available.
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sandbox used to define build configurations-as-code and run arbitrary code in the context of the CI server. Because TeamCity servers hold VCS credentials, deployment keys, and build artifacts, a successful escape effectively compromises the entire build pipeline and downstream software supply chain. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS is low at 0.40% (33rd percentile).
Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by convincing a developer to open a malicious UI Designer form file, leading to full system compromise. No active exploitation or public exploit code has been reported, but a critical-severity vendor patch is available.
Unauthorized file access in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to read files they should not be able to reach during a Remote Development session, bypassing intended authorization controls (CWE-862). The high CVSS score (8.6) reflects a scope-changed confidentiality impact, meaning the exposure can extend beyond the vulnerable component to the host system serving the remote session. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration within an active Remote Development session without proper authorization, tagged by the vendor as an authentication bypass. Because Remote Development connects a local client to a remote backend IDE, tampering with settings can subvert the security boundary between client and host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the vendor-assigned CVSS of 10.0 with scope change signals maximum theoretical severity.
Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to inject unauthorized input into an active Remote Development session, undermining the trust boundary between client and backend host. Because the flaw stems from missing authentication (CWE-306) on a Remote Development channel and carries a maximal CVSS 10.0 with scope change, a successful attacker can influence code, files, or execution on the remote workspace. There is no public exploit identified at time of analysis, but the ceiling severity warrants prompt patching.
Arbitrary code execution in JetBrains IntelliJ IDEA before 2026.2 allows a malicious project to run attacker-controlled code before the user grants project trust, by abusing development container (dev container) configuration that the IDE processes prematurely. Any developer who opens or clones a crafted repository is affected, since code executes ahead of the trust prompt that is supposed to gate untrusted projects. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the local, low-complexity nature and RCE tagging make it a meaningful supply-chain-of-code risk.
Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run attacker-controlled code through the configured interpreter before the developer grants project trust, bypassing the IDE's trust-gate safeguard. Tagged as RCE by the reporting vendor (JetBrains), the flaw carries a CVSS 8.4 and requires a developer to open a crafted project locally. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run code through project tooling before the user grants project trust, bypassing the IDE's trust-boundary safeguard. Reported by JetBrains itself (cve@jetbrains.com) and tagged RCE, it lets an attacker who tricks a developer into opening a crafted repository execute code in the developer's context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the local high-impact (C:H/I:H/A:H) nature makes it relevant for developer-workstation threat models.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run attacker-controlled code on a developer's machine by supplying a crafted linter configuration that the IDE trusts and executes when the project is opened. Reported by JetBrains itself (cve@jetbrains.com) and tagged RCE, the flaw carries CVSS 7.8 (high) with a local vector and required user interaction. There is no public exploit identified at time of analysis and no CISA KEV listing, indicating no confirmed active exploitation to date.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code through the configured Node.js interpreter before the developer grants the project the required trust. Any developer who opens (or clones and opens) an attacker-supplied project is affected, since the IDE's trust prompt - designed to gate execution - is bypassed. No public exploit has been identified and it is not in CISA KEV, but the RCE and Node.js tags plus a local, no-privilege CVSS 8.4 vector make this a meaningful supply-chain/developer-workstation risk.
Arbitrary code execution in JetBrains WebStorm before 2026.2 lets a malicious project run code on a developer's machine before the IDE's project-trust prompt is ever answered, by abusing project-local package-manager tooling that the IDE invokes automatically. Because execution happens prior to the trust gate, the safety boundary meant to protect users who merely open an untrusted repository is bypassed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the RCE tag and full C/I/A impact make this a meaningful developer-workstation risk.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code via project-local linter tooling before the user grants project trust, bypassing the IDE's Trust Projects safeguard. The flaw (CWE-829) affects developers who open or import a crafted repository; no public exploit or active exploitation has been identified, and no EPSS/KEV signal is present in the provided data. Fixed in WebStorm 2026.2.
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-controlled code via the configured Go SDK before the user grants project trust, bypassing the trust-boundary safeguard meant to gate execution. Any developer who merely opens a crafted repository (for example, cloned from a public source) can be compromised without ever clicking 'Trust Project'. This is a CWE-94 code injection weakness with a CVSS 7.8; no public exploit code or active exploitation has been identified at time of analysis.
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code through the Go Modules integration before the developer explicitly grants project trust. Because the trust prompt is meant to be the safeguard against exactly this, opening or previewing a crafted repository is sufficient for compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct-database-access code path, per CWE-306 (missing authentication for a critical function). All self-hosted YouTrack builds prior to the 2026.1.13757 / 2025.3.148033 / 2025.2.148048 / 2025.1.148120 / 2024.3.148430 / 2024.2.148429 fix trains are affected, and JetBrains rates it CVSS 10.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximal severity score and administrative impact make prompt patching essential.
Improper permission enforcement in JetBrains TeamCity before 2026.1.2 lets authenticated low-privilege users modify CI/CD pipelines they should not control, undermining build integrity and potentially exposing pipeline secrets. Reported by JetBrains itself and carrying a CVSS 8.1, the flaw is a missing-authorization issue (CWE-862) rather than a memory-safety bug. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file access in JetBrains TeamCity before 2026.1.2 lets an authenticated user abuse the Perforce (P4) VCS integration to read files outside intended boundaries on the TeamCity server host. The flaw (CWE-73, external control of file name or path) was self-reported by JetBrains and is fixed in 2026.1.2; no public exploit identified at time of analysis, and it is not listed in CISA KEV. With PR:L in the CVSS vector, exploitation requires a low-privilege account that can define or influence a Perforce VCS root, making it a realistic post-authentication threat on shared CI servers.
Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper sanitization of the project workspace ID to write or reference files outside the intended workspace directory, culminating in arbitrary code execution. The flaw was self-reported by JetBrains and a fix is available; no public exploit has been identified at time of analysis. The NVD-assigned CVSS of 9.8 (network, no privileges, no user interaction) is notably high for a desktop IDE flaw and warrants scrutiny given that IDE project-handling bugs typically require a victim to open a crafted project.
Remote code execution in JetBrains Kotlin before 2.4.20 stems from unsafe deserialization (CWE-502) of build cache metadata, allowing an attacker who can influence cached build artifacts to execute arbitrary code during a build. The flaw carries a CVSS 9.8 (C:H/I:H/A:H) rating, but there is no public exploit identified at time of analysis and EPSS is very low (0.11%, 2nd percentile), and CISA SSVC marks exploitation as 'none'. JetBrains, who reported the issue, has released a fixed version (2.4.20).
Prototype pollution in JetBrains YouTrack's websandbox bridge (all versions before 2026.2.16593) lets an attacker who can reach the sandbox boundary corrupt JavaScript Object.prototype, potentially escaping the sandbox or disclosing information. The flaw was internally reported by JetBrains and classed as CWE-1321; it carries a vendor-published CVSS of 9.8, but no public exploit has been identified at time of analysis and EPSS rates exploitation probability low at 0.40% (32nd percentile).
Improper authorization in JetBrains YouTrack's app configurations endpoint lets remote attackers modify project settings they should not be permitted to change, affecting all versions before 2026.2.16593. The flaw (CWE-862, Missing Authorization) impacts integrity only - no data disclosure or service disruption - and was self-reported by JetBrains with a patch already available. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 5th percentile).
Information disclosure in JetBrains YouTrack before 2026.2.16593 allows remote attackers to read other users' private data through a missing authorization check on the comment templates endpoint. The flaw is unauthenticated and network-reachable per the CVSS vector (PR:N), exposing confidential information without any user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%, 6th percentile).
Authentication bypass in JetBrains Hub (the identity and account-management server behind TeamCity, YouTrack, and other JetBrains tools) lets an actor obtain administrative access by going through direct database access, per JetBrains' own advisory. Classified under CWE-306 (Missing Authentication for a Critical Function) and vendor-scored CVSS 9.8, it affects all builds before the fixed 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429 releases. There is no public exploit identified at time of analysis and the EPSS probability is low (0.44%, 35th percentile), but full administrative compromise is the stated technical impact.
Privilege escalation in JetBrains Hub (versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429) allows an authenticated attacker to attach additional authentication details to existing accounts, enabling unauthorized access and elevation of privileges. The flaw, self-reported by JetBrains and patched, carries a CVSS 8.8 with high impact to confidentiality, integrity, and availability; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.41%).
Account takeover in JetBrains Hub is possible through predictable restore codes, affecting all versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429. Remote unauthenticated attackers can guess or predict the restore codes used for account recovery, enabling them to seize control of arbitrary user accounts. No public exploit identified at time of analysis, but the CVSS 9.8 rating reflects the high impact of full account compromise across an identity management platform.
Remote code execution in JetBrains GoLand before 2026.1.3 lets an attacker run arbitrary code on a developer's machine when the victim opens a maliciously crafted project whose configuration is untrusted. The flaw, reported by JetBrains itself and assigned CVSS 8.8 with high confidentiality, integrity, and availability impact, requires the user to open the booby-trapped project (UI:R) but no prior authentication on the IDE. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.21% (11th percentile).
Code execution in JetBrains IntelliJ IDEA prior to 2026.1 is achievable through server-side template injection (SSTI) in the built-in Copyright plugin, which lets an attacker embed executable template expressions into copyright profile configurations. Because the CVSS vector is local with required user interaction (AV:L/UI:R), exploitation hinges on a developer opening or importing a malicious project/profile that triggers the injected template, running with the victim's privileges. There is no public exploit identified at time of analysis and EPSS is 0.00%, consistent with the SSVC 'exploitation: none' assessment.
Information disclosure in JetBrains TeamCity prior to version 2026.1 allows authenticated low-privilege users to read sensitive build configuration parameters they should not have access to due to missing authorization checks. The flaw carries a CVSS 7.6 score driven by high confidentiality impact on a network-reachable CI/CD server, though no public exploit identified at time of analysis. Because TeamCity build parameters frequently contain secrets such as deployment credentials, signing keys, and API tokens, the disclosure can cascade into broader compromise of downstream systems.
Remote code execution in JetBrains TeamCity before 2026.1 allows an authenticated user with project/build configuration rights to run arbitrary code on the CI server by tampering with Perforce (P4) connection settings. The flaw stems from unsafe handling of version-control connection parameters (CWE-88, argument injection), and while it carries a high CVSS of 8.8 with total technical impact, there is no public exploit identified at time of analysis and its EPSS probability is 0.00%.
Server-side request forgery in JetBrains TeamCity versions prior to 2026.1 and 2025.11.5 allows remote unauthenticated attackers to coerce the build server into issuing arbitrary outbound HTTP requests through the build status functionality. The CVSS 7.5 score (C:H/I:N/A:N) reflects high-impact disclosure of internal data without integrity or availability effects, and no public exploit is identified at time of analysis.
Reflected cross-site scripting in JetBrains TeamCity before 2026.1.1 allows an attacker to inject arbitrary script into a victim's browser via the keyword filter parameter, executing in the context of the TeamCity web UI. Because TeamCity is a CI/CD orchestration server holding build secrets and privileged sessions, a tricked authenticated user (e.g. an administrator) clicking a crafted link can have their session or sensitive data compromised. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.01%).
Information disclosure in JetBrains YouTrack before 2026.1.13162 allows remote unauthenticated attackers to obtain sensitive data through fetchApp requests. The flaw exposes confidential information without requiring authentication or user interaction, but carries no integrity or availability impact. There is no public exploit identified at time of analysis, and the EPSS score of 0.00% reflects no observed exploitation activity.
Command execution in JetBrains IntelliJ IDEA before 2026.1.1 allows a holder of the low-privileged guest user account to run operating-system commands it should not be authorized to invoke, effectively bypassing intended authorization boundaries. The flaw carries a CVSS 8.8 rating with total technical impact, but there is no public exploit identified at time of analysis and the EPSS probability is 0.00%, indicating no observed or predicted mass exploitation. It was reported by JetBrains and is fixed in 2026.1.1.
Command injection in JetBrains IntelliJ IDEA before 2026.1.1 allows attackers to execute arbitrary OS commands by abusing the filename completion feature when a developer interacts with a crafted filename. The flaw is locally exploitable with user interaction required and has high impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authentication bypass in JetBrains TeamCity allows remote unauthenticated attackers to gain unauthorized access to server APIs. Despite the CVE description stating 'authenticated users could expose server API,' the CVSS vector (PR:N) confirms no authentication is required for exploitation, enabling direct unauthorized API access with high confidentiality impact and limited integrity impact. JetBrains has released patches in versions 2026.1 and 2025.11.5. EPSS and KEV status not available at time of analysis.
Local file disclosure in IntelliJ IDEA's built-in web server allows remote attackers to read arbitrary local files via network requests requiring user interaction. JetBrains IDEA versions before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, and 2026.1.1 are affected. The vulnerability achieves scope change (CVSS S:C) enabling cross-context information theft with high confidentiality impact but no integrity or availability damage. No active exploitation (KEV-absent) or public POC identified at time of analysis, though vendor disclosure suggests controlled remediation timeline.
Sandbox escape in JetBrains YouTrack before 2025.3.131383 allows high-privileged users to execute arbitrary code on the server. The vulnerability affects all YouTrack versions prior to 2025.3.131383 and is classified as both an authentication bypass and server-side template injection (SSTI). EPSS scoring indicates 0% exploitation probability with no evidence of active exploitation or public POCs. Despite a CVSS score of 7.2, the requirement for high-level administrative privileges significantly constrains real-world attack surface to insider threats or compromised admin accounts.
Authenticated users in JetBrains YouTrack versions prior to 2025.3.121962 can bypass authorization controls to access the app permissions endpoint, potentially allowing privilege escalation or unauthorized modification of application settings. This vulnerability requires valid login credentials but has no complexity requirements, enabling attackers with low-level access to gain high-impact capabilities including confidentiality and integrity violations. No patch is currently available.
JetBrains Hub before 2025.3.119807 has an authentication bypass allowing administrative actions without proper credentials.
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible [CVSS 8.2 HIGH]
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrative actions by bypassing authentication controls on specific endpoints. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, and carries an EPSS score of 82.47% (99th percentile), placing it among the highest-probability exploitation targets currently tracked.
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1, where the IDE injects a pprof HTTP server into profiled processes without any access control. An attacker with network connectivity to the developer workstation during an active profiling session can retrieve heap dumps, goroutine stacks, CPU traces, and in-memory data structures that may contain credentials, tokens, or sensitive application state. No public exploit code exists and this is not listed in CISA KEV; however, the attack requires only standard HTTP requests against an unauthenticated endpoint, making it trivially simple when the prerequisite conditions are met.
IntelliJ IDEA before version 2026.2.2 leaks project metadata to JetBrains Marketplace due to a missing project-trust check, exposing potentially sensitive project information without developer consent. The flaw requires local access and user interaction - specifically, a developer must open an untrusted project for the metadata transmission to occur. No public exploit code exists and no active exploitation has been identified; the impact is limited to a low-severity confidentiality breach (CVSS 3.3).
Server-Side Request Forgery (SSRF) in JetBrains IntelliJ IDEA before version 2026.2.2 allows an attacker to probe internal network resources by embedding a malicious Kubernetes spec-source URL inside a crafted project file. When a developer opens the untrusted project, the IDE automatically fetches the attacker-controlled URL, causing outbound requests to arbitrary hosts reachable from the developer's machine. Impact is limited to partial confidentiality loss (C:L) - internal network topology or service responses may be disclosed - with no integrity or availability consequences. No public exploit code is identified and the vulnerability is not listed in CISA KEV at time of analysis.
Terminal command input written to idea.log in JetBrains IntelliJ IDEA before 2026.2.2 exposes sensitive command-line strings to any local party that can read the IDE's diagnostic log. Classified as CWE-532 (Insertion of Sensitive Information into Log File), the flaw means that developers who type passwords, API keys, or tokens as command-line arguments in IntelliJ's integrated terminal inadvertently persist those secrets on disk in a plaintext log file. No public exploit has been identified at time of analysis, and the vendor-assigned CVSS score of 2.8 accurately reflects the constrained local-only, user-interaction-dependent attack surface.
Privilege escalation in JetBrains YouTrack before version 2026.1.14047 allows an authenticated user holding project update permissions to grant themselves the Project Admin role without proper authorization. The vulnerability stems from a missing escalation check (CWE-266: Incorrect Privilege Assignment) in the project permissions workflow, enabling a project contributor to cross a privilege boundary and assume administrative control over a project. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is known at time of analysis.
Authenticated users in JetBrains YouTrack before 2026.1.14047 can enumerate all group names via predefined search fields, bypassing group visibility permissions enforced elsewhere in the product. The flaw (CWE-862 Missing Authorization) means the access-control check applied to group visibility was not consistently applied to the predefined search field code path, leaking organizational structure to any logged-in user. No active exploitation has been identified and no public exploit code exists; CVSS 4.3 reflects the limited confidentiality impact.
Credential exfiltration in JetBrains YouTrack before 2026.2.18769 allows a project administrator to redirect stored mailbox credentials to an attacker-controlled server by modifying the mailbox host setting without triggering re-authentication. The missing re-authentication gate means any project admin who has been compromised, is malicious, or has temporarily elevated access can silently capture email account credentials (username and password) already stored in YouTrack. No public exploit has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Missing authorization (CWE-862) in JetBrains YouTrack before 2026.2.18769 allows any low-privileged authenticated user to read the email addresses of Helpdesk authorized reporters, who are external contacts registered to submit issues. The flaw bypasses the intended access control on the Helpdesk reporter roster, exposing personally identifiable contact data to users who should have no visibility into it. No public exploit is identified at time of analysis, and the vulnerability has been patched by JetBrains in version 2026.2.18769.
Missing server-side permission checks in JetBrains YouTrack before 2026.2.18687 allow any authenticated user to create knowledge base articles inside projects they are not authorized to access. The flaw is rooted in CWE-862 (Missing Authorization), where the article-creation endpoint omits the necessary access control validation against the caller's project permissions. No public exploit or active exploitation has been identified; the CVSS PR:L metric confirms exploitation is limited to users who already hold a valid YouTrack account.
Improper authorization in JetBrains YouTrack before 2026.2.18634 allows authenticated read-only users to create and modify whiteboard cards, exceeding their intended permissions. The flaw (CWE-863) bypasses YouTrack's role-based access controls for the whiteboard feature, enabling low-privileged users to perform write operations they should be denied. No public exploit code or active exploitation has been identified, and a vendor-confirmed fix is available. EPSS data was not provided; real-world risk is moderate given the authentication prerequisite.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows a high-privileged attacker to inject malicious scripts by uploading crafted project or organization icon files. When other authenticated users subsequently view the affected project or organization page, the stored payload executes in their browser context, enabling session data exposure or unauthorized in-application actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Insufficient permission checks on the app import endpoint in JetBrains YouTrack before version 2026.2.18634 allow an authenticated low-privileged user to overwrite bundled applications, achieving high-integrity impact across all unpatched deployments. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to validate that the requesting account holds sufficient privileges for a destructive write operation against pre-installed components. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in JetBrains YouTrack before 2026.2.18634 allows authenticated low-privileged users to enumerate and read private issues and starred folder contents belonging to other users across organizational boundaries by manipulating user profile API identifiers. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/C:H) reflects straightforward network exploitation requiring only a valid session. No public exploit or KEV listing is present, but the low attack complexity and high confidentiality impact make this a meaningful data-exposure risk in multi-tenant or multi-organization YouTrack deployments.
Insecure Direct Object Reference in JetBrains YouTrack before version 2026.2.18634 permits authenticated users to access other users' private saved searches through the watchRules and issueListConfig API endpoints. The endpoints fail to enforce authorization checks on user-controlled object identifiers, allowing horizontal privilege escalation without elevated permissions. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Authorization bypass in JetBrains YouTrack's whiteboard feature allows authenticated read-only whiteboard users to modify canvas content they should only be able to view, by sending a crafted WebSocket message. Affected versions are all YouTrack releases before 2026.2.18634. The vulnerability stems from CWE-863 (Incorrect Authorization) - the server-side WebSocket handler fails to enforce the read-only permission boundary, accepting write operations from users who lack write privileges. No public exploit or active exploitation has been identified.
The generic VCS webhook handler in JetBrains YouTrack before 2026.2.18634 fails open when no webhook secret is configured, allowing unauthenticated remote callers to trigger webhook processing without any valid credential check. This CWE-306 flaw means that deployments where the webhook secret field is intentionally or inadvertently left blank accept all inbound webhook payloads as legitimate, bypassing the shared-secret verification mechanism. No public exploit code has been identified and the vulnerability is not in CISA KEV; the low CVSS score of 3.7 with AC:H accurately reflects that exploitation is constrained to misconfigured instances.
IP spoofing via forged HTTP headers in JetBrains YouTrack before 2026.2.18634 allows unauthenticated remote attackers to bypass Bitbucket webhook source validation, causing YouTrack to process attacker-crafted webhook payloads as if they originated from a legitimate Bitbucket server. The root cause is CWE-291 - reliance on IP address for authentication - specifically trusting client-controlled headers such as X-Forwarded-For to gate webhook acceptance. No public exploit has been identified at time of analysis, and JetBrains has released a patched build.
Stored XSS in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privilege users to inject AngularJS template expressions through issue assignee name fields, which are then evaluated as client-side JavaScript in the browsers of any user who views the affected issue or project board. The attack persists server-side, meaning every subsequent viewer triggers execution without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privileged users to inject persistent malicious scripts through custom field values displayed on Agile board cards. When a victim with an active YouTrack session views the affected Agile board, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code has been identified at time of analysis, and JetBrains has released a patched version.
Signed URL reuse in JetBrains YouTrack before 2026.2.18634 permits authenticated users to access restricted project icons they are not authorized to view. The flaw arises because signed URLs generated for project icon assets are not properly scoped or invalidated, allowing the same URL to be reused beyond its intended access context. No public exploit code has been identified and the vendor has issued a patch, making this a low-urgency but straightforward authorization control deficiency in a widely used issue tracker.
Cross-site scripting in JetBrains PyCharm's Quick Documentation rendering feature (before version 2026.2.1) enables code execution within the IDE process when a developer inspects documentation for a symbol from a maliciously crafted source. Attackers - including supply-chain adversaries embedding malicious HTML or JavaScript into Python package docstrings - can achieve code execution in PyCharm's local process context once the victim triggers Quick Documentation on an affected symbol. No public exploit has been identified at time of analysis, and JetBrains has released a fix in version 2026.2.1.
XML External Entity injection in JetBrains IntelliJ IDEA's Eclipse settings importer exposes sensitive local files on developer workstations running versions prior to 2026.2.1. The flaw (CWE-611) is triggered when a user imports a maliciously crafted Eclipse settings XML file, allowing an attacker to read arbitrary files accessible to the IDE process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Git credentials are recorded in plaintext to IntelliJ IDEA's local IDE log file in all versions before 2026.1.5, exposing usernames, passwords, and tokens to any entity with read access to those log files. This CWE-532 information disclosure flaw affects the IDE's built-in Git integration subsystem and carries a high confidentiality impact (C:H in CVSS) because exposed credentials can grant full access to remote source code repositories. No public exploit has been identified at time of analysis, and CISA KEV lists no active exploitation.
Local file disclosure in JetBrains IntelliJ IDEA before 2026.2.1 is possible through an XXE injection in the Hadoop ResourceManager integration component. When a developer opens or processes a maliciously crafted XML-based project or configuration file, the unsanitized XML parser resolves external entity references and leaks arbitrary local files - including SSH keys, credentials, and application secrets - to the attacker. The CVSS vector (AV:L/UI:R) confines the risk to local or social-engineering attack paths; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in JetBrains IntelliJ IDEA before version 2026.2.1 allows an attacker who supplies a malicious project to cause the IDE's OpenAPI preview proxy to issue HTTP requests to arbitrary internal or external endpoints. The scope change (S:C in CVSS) indicates the proxy can reach resources beyond the local machine, enabling internal network reconnaissance or credential harvesting from metadata services. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and developer-targeting nature elevate practical concern.
Server-Side Request Forgery in JetBrains IntelliJ IDEA before version 2026.2.1 allows network-accessible attackers to coerce the IDE into issuing arbitrary HTTP requests via the DevKit debug listener endpoint, requiring user interaction to trigger. The vulnerability carries a CVSS 5.4 (Medium) score with low confidentiality and integrity impact, and no availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting limited real-world exploitation pressure currently.
Command injection in JetBrains IntelliJ IDEA before 2026.2.1 enables arbitrary command execution through crafted Markdown preview content when a user opens and trusts a malicious project. The flaw (CWE-77) is constrained to trusted projects and requires the victim to interact with the Markdown preview, limiting its practical reach. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor-assigned CVSS score of 3.6 (Low) reflects these mitigating conditions.
Denial-of-service in JetBrains YouTrack before versions 2026.1.13901 and 2026.2.17950 allows authenticated remote attackers to exhaust server resources by submitting crafted type parameters, rendering the service unavailable. The vulnerability stems from uncontrolled resource consumption (CWE-770), where malformed input is not bounded before processing. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized cross-project article disclosure in JetBrains YouTrack allows any authenticated user to read restricted knowledge base articles belonging to projects they are not authorized to access, by exploiting a missing authorization check on the draft creation endpoint. Affected are all YouTrack deployments running versions before 2026.1.13903 and 2026.2.17950. No public exploit or active exploitation has been identified, but the low attack complexity and network-accessible vector make this trivially repeatable by any valid account holder on the instance.
Host-level code execution in JetBrains IntelliJ IDEA before 2026.2.2 is triggered when a developer opens a malicious project containing a crafted Dev Container configuration, which the IDE proceeds to build without first requesting the standard project-trust confirmation. The flaw (CWE-829) allows untrusted, project-defined container build scripts and Docker commands to execute directly on the developer's host machine, bypassing the IDE's safety gate. JetBrains confirmed the issue and released a fix in version 2026.2.2; no public exploit has been identified at time of analysis.
Local code execution on Remote Development hosts is possible in JetBrains IntelliJ IDEA versions before 2026.2.2 due to the IJent gRPC server running without TLS encryption or any authentication mechanism. The IJent agent, deployed on remote hosts when the Remote Development feature is in use, accepts connections from any local process without requiring credentials, enabling arbitrary command execution under the agent's security context. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Incorrect authorization in JetBrains YouTrack before versions 2025.3.160480 and 2026.1.14047 allows authenticated low-privilege users to modify linked issue entities they lack update permission on by issuing PUT requests directly to link sub-resources. The flaw bypasses YouTrack's permission model at the HTTP method level, enabling integrity violations across project boundaries-reflected in the CVSS scope change (S:C). No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized integrity modification in JetBrains YouTrack before 2026.2.18634 allows any authenticated low-privilege user to alter links on issues they are explicitly prohibited from accessing by exploiting the whiteboard clone operation. The whiteboard clone workflow fails to validate the cloning user's authorization against issues referenced in the board, enabling cross-boundary write access governed by CWE-862 (Missing Authorization). No public exploit has been identified at time of analysis, but the CVSS 7.7 vector (S:C, I:H, PR:L, AC:L) accurately reflects the low barrier to exploitation and the cross-domain integrity impact.
Cross-tenant GitHub App installation token theft in JetBrains YouTrack before 2026.2.18634 lets any authenticated user retrieve GitHub App installation tokens belonging to other tenants due to a shared, non-isolated token cache. The root cause is CWE-488 (Exposure of Data Element to Wrong Session): cached tokens were keyed without tenant-scope isolation. With a stolen installation token, an attacker can authenticate to the GitHub API as the victim organization's GitHub App, gaining access to that organization's repositories, pull requests, issues, and CI/CD integrations; no public exploit has been identified at time of analysis.
Privilege escalation in JetBrains YouTrack before version 2026.2.18634 enables authenticated low-privileged users to alter group memberships without proper server-side authorization validation, effectively granting themselves elevated rights. The flaw (CWE-266, Incorrect Privilege Assignment) means the application trusts client-supplied group membership parameters without enforcing that the requesting user has the authority to make such changes. With a CVSS base score of 8.8 and full C:H/I:H/A:H impact, successful exploitation yields the equivalent of full administrative control over the YouTrack instance.
Privilege escalation to superuser in JetBrains Hub before 2026.2.52442 allows an unauthenticated remote attacker to register a trusted service and thereby obtain full administrative (superuser) control over the identity-management server. Because Hub is the single sign-on and authorization backbone for JetBrains tooling (YouTrack, TeamCity, Upsource), compromise cascades to every application relying on it for authentication. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Missing authorization in JetBrains YouTrack's REST API allows authenticated low-privileged users to access and modify restricted resources via Insecure Direct Object Reference (IDOR). Affected versions span all YouTrack releases prior to 2026.2.18788, 2026.1.14055, and 2025.3.161254 across three active release branches. An attacker with any valid account can enumerate or directly reference object identifiers in REST API calls to read or write data they should not have access to, with high confidentiality and integrity impact per the CVSS vector.
Unauthenticated account takeover in JetBrains YouTrack's Helpdesk feature allows a remote attacker to hijack existing accounts by asserting a victim's email address without proving ownership of it. All YouTrack builds before 2025.3.161254 and 2026.1.14042 are affected. Because the flaw is a trust failure in how Helpdesk associates a self-provided email with an account, exploitation requires no credentials, no user interaction, and works against default configurations where Helpdesk is enabled. No public exploit identified at time of analysis.
Code execution in JetBrains PyCharm before 2026.2.1 is possible through Jupyter MCP (Model Context Protocol) tools that expose critical functions without authentication. The root cause is CWE-306 (Missing Authentication for Critical Function) - the MCP tool surface in PyCharm's Jupyter integration fails to enforce any authentication check before executing code. Any local attacker able to reach the MCP endpoint can trigger arbitrary code execution with the privileges of the running PyCharm process, achieving full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis.
Remote code execution in JetBrains IntelliJ IDEA before version 2026.2.1 is achievable through the Markdown export tool via OS command injection. An attacker who can deliver a crafted Markdown file to a developer and induce them to export it can execute arbitrary operating system commands in the context of the IntelliJ IDEA process. No public exploit or CISA KEV listing has been identified at time of analysis, but the CWE-78 root cause and full C/H/I/H/A:H impact make this a meaningful risk for development workstation environments.
Unauthorized project transfer between organizations in JetBrains YouTrack before version 2026.2.17917 exposes high-severity access control failure affecting any multi-tenant or multi-organization deployment. Any authenticated low-privileged user can transfer projects across organizational boundaries without holding the necessary authorization, resulting in high confidentiality and integrity impact against affected projects and their data. No public exploit or CISA KEV listing is identified at time of analysis, but the low attack complexity and authentication-only requirement make this straightforwardly exploitable by any active YouTrack user.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.18068 allows remote attackers to persist malicious script payloads via the language label field of fenced code blocks in issues or comments. When any authenticated user views the affected content, the injected script executes within the YouTrack application origin - a scope change that enables session token theft, credential harvesting, or unauthorized actions on behalf of the victim (CVSS C:H). No public exploit code has been identified at time of analysis, but the low-complexity network vector makes this straightforward to weaponize once a reporter or contributor role is obtained.
Unauthenticated database backup disclosure in JetBrains YouTrack before 2025.3.156085, 2026.1.13913, and 2026.2.18112 allows a remote attacker to abuse a shared draft signature to download full database backups without any credentials. Because backups typically contain issue data, user records, and secrets, this is a high-impact confidentiality exposure. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CVSS 9.1 rating and trivial network exploitability make it a priority patch.
Missing authorization on the mailbox endpoint in JetBrains YouTrack enables any authenticated user to delete arbitrary entities across the platform, regardless of ownership or role. Affected versions span three active release branches: all releases prior to 2025.3.156085, 2026.1.13914, and 2026.2.18095. The CVSS 3.1 score of 8.1 (High) reflects high integrity and availability impact with a low-privilege authentication bar; no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute arbitrary code via deserialization of untrusted data in the agent polling protocol. The vulnerability carries a CVSS 9.8 score and poses immediate risk to any exposed TeamCity instance. No public exploit or active exploitation has been confirmed at the time of analysis.
Code execution in JetBrains TeamCity (before 2026.1.2 and 2025.11.6) allows a privileged user to run arbitrary code through Git VCS root configuration, mapping to CWE-94 code injection. The CVSS 3.1 score of 9.1 reflects a scope-changing flaw (S:C) that requires high privileges (PR:H) but no user interaction, meaning an attacker with rights to configure VCS roots can escalate into code execution on the CI/CD infrastructure. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by JetBrains.
Arbitrary code execution in JetBrains PyCharm before 2026.1.4 and 2026.2 lets an attacker who supplies a crafted project achieve code execution when a victim opens that untrusted project in the IDE. PyCharm auto-selects or trusts a Python executable bundled or referenced by the project, so merely opening the malicious project runs attacker-controlled code with the user's privileges. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the reporter is JetBrains itself and a vendor patch is available.
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sandbox used to define build configurations-as-code and run arbitrary code in the context of the CI server. Because TeamCity servers hold VCS credentials, deployment keys, and build artifacts, a successful escape effectively compromises the entire build pipeline and downstream software supply chain. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; EPSS is low at 0.40% (33rd percentile).
Arbitrary code injection in IntelliJ IDEA before version 2026.2 allows remote attackers to execute arbitrary code by convincing a developer to open a malicious UI Designer form file, leading to full system compromise. No active exploitation or public exploit code has been reported, but a critical-severity vendor patch is available.
Unauthorized file access in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to read files they should not be able to reach during a Remote Development session, bypassing intended authorization controls (CWE-862). The high CVSS score (8.6) reflects a scope-changed confidentiality impact, meaning the exposure can extend beyond the vulnerable component to the host system serving the remote session. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Unauthorized settings modification in JetBrains IntelliJ IDEA before 2026.2 allows attackers to alter configuration within an active Remote Development session without proper authorization, tagged by the vendor as an authentication bypass. Because Remote Development connects a local client to a remote backend IDE, tampering with settings can subvert the security boundary between client and host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the vendor-assigned CVSS of 10.0 with scope change signals maximum theoretical severity.
Authentication bypass via unauthorized input injection in JetBrains IntelliJ IDEA before 2026.2 allows remote attackers to inject unauthorized input into an active Remote Development session, undermining the trust boundary between client and backend host. Because the flaw stems from missing authentication (CWE-306) on a Remote Development channel and carries a maximal CVSS 10.0 with scope change, a successful attacker can influence code, files, or execution on the remote workspace. There is no public exploit identified at time of analysis, but the ceiling severity warrants prompt patching.
Arbitrary code execution in JetBrains IntelliJ IDEA before 2026.2 allows a malicious project to run attacker-controlled code before the user grants project trust, by abusing development container (dev container) configuration that the IDE processes prematurely. Any developer who opens or clones a crafted repository is affected, since code executes ahead of the trust prompt that is supposed to gate untrusted projects. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the local, low-complexity nature and RCE tagging make it a meaningful supply-chain-of-code risk.
Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run attacker-controlled code through the configured interpreter before the developer grants project trust, bypassing the IDE's trust-gate safeguard. Tagged as RCE by the reporting vendor (JetBrains), the flaw carries a CVSS 8.4 and requires a developer to open a crafted project locally. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run code through project tooling before the user grants project trust, bypassing the IDE's trust-boundary safeguard. Reported by JetBrains itself (cve@jetbrains.com) and tagged RCE, it lets an attacker who tricks a developer into opening a crafted repository execute code in the developer's context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the local high-impact (C:H/I:H/A:H) nature makes it relevant for developer-workstation threat models.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run attacker-controlled code on a developer's machine by supplying a crafted linter configuration that the IDE trusts and executes when the project is opened. Reported by JetBrains itself (cve@jetbrains.com) and tagged RCE, the flaw carries CVSS 7.8 (high) with a local vector and required user interaction. There is no public exploit identified at time of analysis and no CISA KEV listing, indicating no confirmed active exploitation to date.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code through the configured Node.js interpreter before the developer grants the project the required trust. Any developer who opens (or clones and opens) an attacker-supplied project is affected, since the IDE's trust prompt - designed to gate execution - is bypassed. No public exploit has been identified and it is not in CISA KEV, but the RCE and Node.js tags plus a local, no-privilege CVSS 8.4 vector make this a meaningful supply-chain/developer-workstation risk.
Arbitrary code execution in JetBrains WebStorm before 2026.2 lets a malicious project run code on a developer's machine before the IDE's project-trust prompt is ever answered, by abusing project-local package-manager tooling that the IDE invokes automatically. Because execution happens prior to the trust gate, the safety boundary meant to protect users who merely open an untrusted repository is bypassed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the RCE tag and full C/I/A impact make this a meaningful developer-workstation risk.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code via project-local linter tooling before the user grants project trust, bypassing the IDE's Trust Projects safeguard. The flaw (CWE-829) affects developers who open or import a crafted repository; no public exploit or active exploitation has been identified, and no EPSS/KEV signal is present in the provided data. Fixed in WebStorm 2026.2.
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-controlled code via the configured Go SDK before the user grants project trust, bypassing the trust-boundary safeguard meant to gate execution. Any developer who merely opens a crafted repository (for example, cloned from a public source) can be compromised without ever clicking 'Trust Project'. This is a CWE-94 code injection weakness with a CVSS 7.8; no public exploit code or active exploitation has been identified at time of analysis.
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code through the Go Modules integration before the developer explicitly grants project trust. Because the trust prompt is meant to be the safeguard against exactly this, opening or previewing a crafted repository is sufficient for compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in JetBrains YouTrack allows attackers to obtain full administrative access by leveraging a direct-database-access code path, per CWE-306 (missing authentication for a critical function). All self-hosted YouTrack builds prior to the 2026.1.13757 / 2025.3.148033 / 2025.2.148048 / 2025.1.148120 / 2024.3.148430 / 2024.2.148429 fix trains are affected, and JetBrains rates it CVSS 10.0. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the maximal severity score and administrative impact make prompt patching essential.
Improper permission enforcement in JetBrains TeamCity before 2026.1.2 lets authenticated low-privilege users modify CI/CD pipelines they should not control, undermining build integrity and potentially exposing pipeline secrets. Reported by JetBrains itself and carrying a CVSS 8.1, the flaw is a missing-authorization issue (CWE-862) rather than a memory-safety bug. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Arbitrary file access in JetBrains TeamCity before 2026.1.2 lets an authenticated user abuse the Perforce (P4) VCS integration to read files outside intended boundaries on the TeamCity server host. The flaw (CWE-73, external control of file name or path) was self-reported by JetBrains and is fixed in 2026.1.2; no public exploit identified at time of analysis, and it is not listed in CISA KEV. With PR:L in the CVSS vector, exploitation requires a low-privilege account that can define or influence a Perforce VCS root, making it a realistic post-authentication threat on shared CI servers.
Code execution via path traversal in JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2 lets an attacker abuse improper sanitization of the project workspace ID to write or reference files outside the intended workspace directory, culminating in arbitrary code execution. The flaw was self-reported by JetBrains and a fix is available; no public exploit has been identified at time of analysis. The NVD-assigned CVSS of 9.8 (network, no privileges, no user interaction) is notably high for a desktop IDE flaw and warrants scrutiny given that IDE project-handling bugs typically require a victim to open a crafted project.
Remote code execution in JetBrains Kotlin before 2.4.20 stems from unsafe deserialization (CWE-502) of build cache metadata, allowing an attacker who can influence cached build artifacts to execute arbitrary code during a build. The flaw carries a CVSS 9.8 (C:H/I:H/A:H) rating, but there is no public exploit identified at time of analysis and EPSS is very low (0.11%, 2nd percentile), and CISA SSVC marks exploitation as 'none'. JetBrains, who reported the issue, has released a fixed version (2.4.20).
Prototype pollution in JetBrains YouTrack's websandbox bridge (all versions before 2026.2.16593) lets an attacker who can reach the sandbox boundary corrupt JavaScript Object.prototype, potentially escaping the sandbox or disclosing information. The flaw was internally reported by JetBrains and classed as CWE-1321; it carries a vendor-published CVSS of 9.8, but no public exploit has been identified at time of analysis and EPSS rates exploitation probability low at 0.40% (32nd percentile).
Improper authorization in JetBrains YouTrack's app configurations endpoint lets remote attackers modify project settings they should not be permitted to change, affecting all versions before 2026.2.16593. The flaw (CWE-862, Missing Authorization) impacts integrity only - no data disclosure or service disruption - and was self-reported by JetBrains with a patch already available. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 5th percentile).
Information disclosure in JetBrains YouTrack before 2026.2.16593 allows remote attackers to read other users' private data through a missing authorization check on the comment templates endpoint. The flaw is unauthenticated and network-reachable per the CVSS vector (PR:N), exposing confidential information without any user interaction. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.16%, 6th percentile).
Authentication bypass in JetBrains Hub (the identity and account-management server behind TeamCity, YouTrack, and other JetBrains tools) lets an actor obtain administrative access by going through direct database access, per JetBrains' own advisory. Classified under CWE-306 (Missing Authentication for a Critical Function) and vendor-scored CVSS 9.8, it affects all builds before the fixed 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429 releases. There is no public exploit identified at time of analysis and the EPSS probability is low (0.44%, 35th percentile), but full administrative compromise is the stated technical impact.
Privilege escalation in JetBrains Hub (versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429) allows an authenticated attacker to attach additional authentication details to existing accounts, enabling unauthorized access and elevation of privileges. The flaw, self-reported by JetBrains and patched, carries a CVSS 8.8 with high impact to confidentiality, integrity, and availability; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.41%).
Account takeover in JetBrains Hub is possible through predictable restore codes, affecting all versions prior to 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429. Remote unauthenticated attackers can guess or predict the restore codes used for account recovery, enabling them to seize control of arbitrary user accounts. No public exploit identified at time of analysis, but the CVSS 9.8 rating reflects the high impact of full account compromise across an identity management platform.
Remote code execution in JetBrains GoLand before 2026.1.3 lets an attacker run arbitrary code on a developer's machine when the victim opens a maliciously crafted project whose configuration is untrusted. The flaw, reported by JetBrains itself and assigned CVSS 8.8 with high confidentiality, integrity, and availability impact, requires the user to open the booby-trapped project (UI:R) but no prior authentication on the IDE. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.21% (11th percentile).
Code execution in JetBrains IntelliJ IDEA prior to 2026.1 is achievable through server-side template injection (SSTI) in the built-in Copyright plugin, which lets an attacker embed executable template expressions into copyright profile configurations. Because the CVSS vector is local with required user interaction (AV:L/UI:R), exploitation hinges on a developer opening or importing a malicious project/profile that triggers the injected template, running with the victim's privileges. There is no public exploit identified at time of analysis and EPSS is 0.00%, consistent with the SSVC 'exploitation: none' assessment.
Information disclosure in JetBrains TeamCity prior to version 2026.1 allows authenticated low-privilege users to read sensitive build configuration parameters they should not have access to due to missing authorization checks. The flaw carries a CVSS 7.6 score driven by high confidentiality impact on a network-reachable CI/CD server, though no public exploit identified at time of analysis. Because TeamCity build parameters frequently contain secrets such as deployment credentials, signing keys, and API tokens, the disclosure can cascade into broader compromise of downstream systems.
Remote code execution in JetBrains TeamCity before 2026.1 allows an authenticated user with project/build configuration rights to run arbitrary code on the CI server by tampering with Perforce (P4) connection settings. The flaw stems from unsafe handling of version-control connection parameters (CWE-88, argument injection), and while it carries a high CVSS of 8.8 with total technical impact, there is no public exploit identified at time of analysis and its EPSS probability is 0.00%.
Server-side request forgery in JetBrains TeamCity versions prior to 2026.1 and 2025.11.5 allows remote unauthenticated attackers to coerce the build server into issuing arbitrary outbound HTTP requests through the build status functionality. The CVSS 7.5 score (C:H/I:N/A:N) reflects high-impact disclosure of internal data without integrity or availability effects, and no public exploit is identified at time of analysis.
Reflected cross-site scripting in JetBrains TeamCity before 2026.1.1 allows an attacker to inject arbitrary script into a victim's browser via the keyword filter parameter, executing in the context of the TeamCity web UI. Because TeamCity is a CI/CD orchestration server holding build secrets and privileged sessions, a tricked authenticated user (e.g. an administrator) clicking a crafted link can have their session or sensitive data compromised. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.01%).
Information disclosure in JetBrains YouTrack before 2026.1.13162 allows remote unauthenticated attackers to obtain sensitive data through fetchApp requests. The flaw exposes confidential information without requiring authentication or user interaction, but carries no integrity or availability impact. There is no public exploit identified at time of analysis, and the EPSS score of 0.00% reflects no observed exploitation activity.
Command execution in JetBrains IntelliJ IDEA before 2026.1.1 allows a holder of the low-privileged guest user account to run operating-system commands it should not be authorized to invoke, effectively bypassing intended authorization boundaries. The flaw carries a CVSS 8.8 rating with total technical impact, but there is no public exploit identified at time of analysis and the EPSS probability is 0.00%, indicating no observed or predicted mass exploitation. It was reported by JetBrains and is fixed in 2026.1.1.
Command injection in JetBrains IntelliJ IDEA before 2026.1.1 allows attackers to execute arbitrary OS commands by abusing the filename completion feature when a developer interacts with a crafted filename. The flaw is locally exploitable with user interaction required and has high impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Authentication bypass in JetBrains TeamCity allows remote unauthenticated attackers to gain unauthorized access to server APIs. Despite the CVE description stating 'authenticated users could expose server API,' the CVSS vector (PR:N) confirms no authentication is required for exploitation, enabling direct unauthorized API access with high confidentiality impact and limited integrity impact. JetBrains has released patches in versions 2026.1 and 2025.11.5. EPSS and KEV status not available at time of analysis.
Local file disclosure in IntelliJ IDEA's built-in web server allows remote attackers to read arbitrary local files via network requests requiring user interaction. JetBrains IDEA versions before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, and 2026.1.1 are affected. The vulnerability achieves scope change (CVSS S:C) enabling cross-context information theft with high confidentiality impact but no integrity or availability damage. No active exploitation (KEV-absent) or public POC identified at time of analysis, though vendor disclosure suggests controlled remediation timeline.
Sandbox escape in JetBrains YouTrack before 2025.3.131383 allows high-privileged users to execute arbitrary code on the server. The vulnerability affects all YouTrack versions prior to 2025.3.131383 and is classified as both an authentication bypass and server-side template injection (SSTI). EPSS scoring indicates 0% exploitation probability with no evidence of active exploitation or public POCs. Despite a CVSS score of 7.2, the requirement for high-level administrative privileges significantly constrains real-world attack surface to insider threats or compromised admin accounts.
Authenticated users in JetBrains YouTrack versions prior to 2025.3.121962 can bypass authorization controls to access the app permissions endpoint, potentially allowing privilege escalation or unauthorized modification of application settings. This vulnerability requires valid login credentials but has no complexity requirements, enabling attackers with low-level access to gain high-impact capabilities including confidentiality and integrity violations. No patch is currently available.
JetBrains Hub before 2025.3.119807 has an authentication bypass allowing administrative actions without proper credentials.
In JetBrains PyCharm before 2025.3.2 a DOM-based XSS on Jupyter viewer page was possible [CVSS 8.2 HIGH]
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrative actions by bypassing authentication controls on specific endpoints. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, and carries an EPSS score of 82.47% (99th percentile), placing it among the highest-probability exploitation targets currently tracked.
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1, where the IDE injects a pprof HTTP server into profiled processes without any access control. An attacker with network connectivity to the developer workstation during an active profiling session can retrieve heap dumps, goroutine stacks, CPU traces, and in-memory data structures that may contain credentials, tokens, or sensitive application state. No public exploit code exists and this is not listed in CISA KEV; however, the attack requires only standard HTTP requests against an unauthenticated endpoint, making it trivially simple when the prerequisite conditions are met.
IntelliJ IDEA before version 2026.2.2 leaks project metadata to JetBrains Marketplace due to a missing project-trust check, exposing potentially sensitive project information without developer consent. The flaw requires local access and user interaction - specifically, a developer must open an untrusted project for the metadata transmission to occur. No public exploit code exists and no active exploitation has been identified; the impact is limited to a low-severity confidentiality breach (CVSS 3.3).
Server-Side Request Forgery (SSRF) in JetBrains IntelliJ IDEA before version 2026.2.2 allows an attacker to probe internal network resources by embedding a malicious Kubernetes spec-source URL inside a crafted project file. When a developer opens the untrusted project, the IDE automatically fetches the attacker-controlled URL, causing outbound requests to arbitrary hosts reachable from the developer's machine. Impact is limited to partial confidentiality loss (C:L) - internal network topology or service responses may be disclosed - with no integrity or availability consequences. No public exploit code is identified and the vulnerability is not listed in CISA KEV at time of analysis.
Terminal command input written to idea.log in JetBrains IntelliJ IDEA before 2026.2.2 exposes sensitive command-line strings to any local party that can read the IDE's diagnostic log. Classified as CWE-532 (Insertion of Sensitive Information into Log File), the flaw means that developers who type passwords, API keys, or tokens as command-line arguments in IntelliJ's integrated terminal inadvertently persist those secrets on disk in a plaintext log file. No public exploit has been identified at time of analysis, and the vendor-assigned CVSS score of 2.8 accurately reflects the constrained local-only, user-interaction-dependent attack surface.
Privilege escalation in JetBrains YouTrack before version 2026.1.14047 allows an authenticated user holding project update permissions to grant themselves the Project Admin role without proper authorization. The vulnerability stems from a missing escalation check (CWE-266: Incorrect Privilege Assignment) in the project permissions workflow, enabling a project contributor to cross a privilege boundary and assume administrative control over a project. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is known at time of analysis.
Authenticated users in JetBrains YouTrack before 2026.1.14047 can enumerate all group names via predefined search fields, bypassing group visibility permissions enforced elsewhere in the product. The flaw (CWE-862 Missing Authorization) means the access-control check applied to group visibility was not consistently applied to the predefined search field code path, leaking organizational structure to any logged-in user. No active exploitation has been identified and no public exploit code exists; CVSS 4.3 reflects the limited confidentiality impact.
Credential exfiltration in JetBrains YouTrack before 2026.2.18769 allows a project administrator to redirect stored mailbox credentials to an attacker-controlled server by modifying the mailbox host setting without triggering re-authentication. The missing re-authentication gate means any project admin who has been compromised, is malicious, or has temporarily elevated access can silently capture email account credentials (username and password) already stored in YouTrack. No public exploit has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Missing authorization (CWE-862) in JetBrains YouTrack before 2026.2.18769 allows any low-privileged authenticated user to read the email addresses of Helpdesk authorized reporters, who are external contacts registered to submit issues. The flaw bypasses the intended access control on the Helpdesk reporter roster, exposing personally identifiable contact data to users who should have no visibility into it. No public exploit is identified at time of analysis, and the vulnerability has been patched by JetBrains in version 2026.2.18769.
Missing server-side permission checks in JetBrains YouTrack before 2026.2.18687 allow any authenticated user to create knowledge base articles inside projects they are not authorized to access. The flaw is rooted in CWE-862 (Missing Authorization), where the article-creation endpoint omits the necessary access control validation against the caller's project permissions. No public exploit or active exploitation has been identified; the CVSS PR:L metric confirms exploitation is limited to users who already hold a valid YouTrack account.
Improper authorization in JetBrains YouTrack before 2026.2.18634 allows authenticated read-only users to create and modify whiteboard cards, exceeding their intended permissions. The flaw (CWE-863) bypasses YouTrack's role-based access controls for the whiteboard feature, enabling low-privileged users to perform write operations they should be denied. No public exploit code or active exploitation has been identified, and a vendor-confirmed fix is available. EPSS data was not provided; real-world risk is moderate given the authentication prerequisite.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows a high-privileged attacker to inject malicious scripts by uploading crafted project or organization icon files. When other authenticated users subsequently view the affected project or organization page, the stored payload executes in their browser context, enabling session data exposure or unauthorized in-application actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Insufficient permission checks on the app import endpoint in JetBrains YouTrack before version 2026.2.18634 allow an authenticated low-privileged user to overwrite bundled applications, achieving high-integrity impact across all unpatched deployments. The flaw is rooted in CWE-863 (Incorrect Authorization), meaning the server fails to validate that the requesting account holds sufficient privileges for a destructive write operation against pre-installed components. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Insecure Direct Object Reference (IDOR) in JetBrains YouTrack before 2026.2.18634 allows authenticated low-privileged users to enumerate and read private issues and starred folder contents belonging to other users across organizational boundaries by manipulating user profile API identifiers. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/C:H) reflects straightforward network exploitation requiring only a valid session. No public exploit or KEV listing is present, but the low attack complexity and high confidentiality impact make this a meaningful data-exposure risk in multi-tenant or multi-organization YouTrack deployments.
Insecure Direct Object Reference in JetBrains YouTrack before version 2026.2.18634 permits authenticated users to access other users' private saved searches through the watchRules and issueListConfig API endpoints. The endpoints fail to enforce authorization checks on user-controlled object identifiers, allowing horizontal privilege escalation without elevated permissions. No active exploitation or public proof-of-concept code has been identified at time of analysis.
Authorization bypass in JetBrains YouTrack's whiteboard feature allows authenticated read-only whiteboard users to modify canvas content they should only be able to view, by sending a crafted WebSocket message. Affected versions are all YouTrack releases before 2026.2.18634. The vulnerability stems from CWE-863 (Incorrect Authorization) - the server-side WebSocket handler fails to enforce the read-only permission boundary, accepting write operations from users who lack write privileges. No public exploit or active exploitation has been identified.
The generic VCS webhook handler in JetBrains YouTrack before 2026.2.18634 fails open when no webhook secret is configured, allowing unauthenticated remote callers to trigger webhook processing without any valid credential check. This CWE-306 flaw means that deployments where the webhook secret field is intentionally or inadvertently left blank accept all inbound webhook payloads as legitimate, bypassing the shared-secret verification mechanism. No public exploit code has been identified and the vulnerability is not in CISA KEV; the low CVSS score of 3.7 with AC:H accurately reflects that exploitation is constrained to misconfigured instances.
IP spoofing via forged HTTP headers in JetBrains YouTrack before 2026.2.18634 allows unauthenticated remote attackers to bypass Bitbucket webhook source validation, causing YouTrack to process attacker-crafted webhook payloads as if they originated from a legitimate Bitbucket server. The root cause is CWE-291 - reliance on IP address for authentication - specifically trusting client-controlled headers such as X-Forwarded-For to gate webhook acceptance. No public exploit has been identified at time of analysis, and JetBrains has released a patched build.
Stored XSS in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privilege users to inject AngularJS template expressions through issue assignee name fields, which are then evaluated as client-side JavaScript in the browsers of any user who views the affected issue or project board. The attack persists server-side, meaning every subsequent viewer triggers execution without further attacker interaction. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Stored cross-site scripting in JetBrains YouTrack before version 2026.2.18634 allows authenticated low-privileged users to inject persistent malicious scripts through custom field values displayed on Agile board cards. When a victim with an active YouTrack session views the affected Agile board, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code has been identified at time of analysis, and JetBrains has released a patched version.
Signed URL reuse in JetBrains YouTrack before 2026.2.18634 permits authenticated users to access restricted project icons they are not authorized to view. The flaw arises because signed URLs generated for project icon assets are not properly scoped or invalidated, allowing the same URL to be reused beyond its intended access context. No public exploit code has been identified and the vendor has issued a patch, making this a low-urgency but straightforward authorization control deficiency in a widely used issue tracker.
Cross-site scripting in JetBrains PyCharm's Quick Documentation rendering feature (before version 2026.2.1) enables code execution within the IDE process when a developer inspects documentation for a symbol from a maliciously crafted source. Attackers - including supply-chain adversaries embedding malicious HTML or JavaScript into Python package docstrings - can achieve code execution in PyCharm's local process context once the victim triggers Quick Documentation on an affected symbol. No public exploit has been identified at time of analysis, and JetBrains has released a fix in version 2026.2.1.
XML External Entity injection in JetBrains IntelliJ IDEA's Eclipse settings importer exposes sensitive local files on developer workstations running versions prior to 2026.2.1. The flaw (CWE-611) is triggered when a user imports a maliciously crafted Eclipse settings XML file, allowing an attacker to read arbitrary files accessible to the IDE process. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Git credentials are recorded in plaintext to IntelliJ IDEA's local IDE log file in all versions before 2026.1.5, exposing usernames, passwords, and tokens to any entity with read access to those log files. This CWE-532 information disclosure flaw affects the IDE's built-in Git integration subsystem and carries a high confidentiality impact (C:H in CVSS) because exposed credentials can grant full access to remote source code repositories. No public exploit has been identified at time of analysis, and CISA KEV lists no active exploitation.
Local file disclosure in JetBrains IntelliJ IDEA before 2026.2.1 is possible through an XXE injection in the Hadoop ResourceManager integration component. When a developer opens or processes a maliciously crafted XML-based project or configuration file, the unsanitized XML parser resolves external entity references and leaks arbitrary local files - including SSH keys, credentials, and application secrets - to the attacker. The CVSS vector (AV:L/UI:R) confines the risk to local or social-engineering attack paths; no public exploit or CISA KEV listing has been identified at time of analysis.
Server-Side Request Forgery in JetBrains IntelliJ IDEA before version 2026.2.1 allows an attacker who supplies a malicious project to cause the IDE's OpenAPI preview proxy to issue HTTP requests to arbitrary internal or external endpoints. The scope change (S:C in CVSS) indicates the proxy can reach resources beyond the local machine, enabling internal network reconnaissance or credential harvesting from metadata services. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the high confidentiality impact and developer-targeting nature elevate practical concern.
Server-Side Request Forgery in JetBrains IntelliJ IDEA before version 2026.2.1 allows network-accessible attackers to coerce the IDE into issuing arbitrary HTTP requests via the DevKit debug listener endpoint, requiring user interaction to trigger. The vulnerability carries a CVSS 5.4 (Medium) score with low confidentiality and integrity impact, and no availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, suggesting limited real-world exploitation pressure currently.
Command injection in JetBrains IntelliJ IDEA before 2026.2.1 enables arbitrary command execution through crafted Markdown preview content when a user opens and trusts a malicious project. The flaw (CWE-77) is constrained to trusted projects and requires the victim to interact with the Markdown preview, limiting its practical reach. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor-assigned CVSS score of 3.6 (Low) reflects these mitigating conditions.
Denial-of-service in JetBrains YouTrack before versions 2026.1.13901 and 2026.2.17950 allows authenticated remote attackers to exhaust server resources by submitting crafted type parameters, rendering the service unavailable. The vulnerability stems from uncontrolled resource consumption (CWE-770), where malformed input is not bounded before processing. No public exploit code or active exploitation has been identified at time of analysis.
Unauthorized cross-project article disclosure in JetBrains YouTrack allows any authenticated user to read restricted knowledge base articles belonging to projects they are not authorized to access, by exploiting a missing authorization check on the draft creation endpoint. Affected are all YouTrack deployments running versions before 2026.1.13903 and 2026.2.17950. No public exploit or active exploitation has been identified, but the low attack complexity and network-accessible vector make this trivially repeatable by any valid account holder on the instance.