Vulnerabilidades do Jetbrains Intellij Idea

CVE-2026-100256 Alta · 7.8 CWE-829 30/09/2026

In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints…

In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects

CVE-2026-86505 Baixa · 3.3 CWE-201 07/09/2026

Insertion of Sensitive Information Into Sent Data em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace

CVE-2026-86504 Alta · 7.8 CWE-829 07/09/2026

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before…

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution

CVE-2026-86503 Baixa · 3.3 CWE-918 07/09/2026

Server-Side Request Forgery (SSRF) em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching

CVE-2026-86502 Alta · 8.4 CWE-306 07/09/2026

Missing Authentication for Critical Function em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

CVE-2026-86501 Baixa · 2.8 CWE-532 07/09/2026

Insertion of Sensitive Information into Log File em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log

CVE-2026-75058 Média · 5.5 CWE-611 17/08/2026

XML External Entity (XXE) em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers

CVE-2026-75057 Média · 6.2 CWE-532 17/08/2026

Insertion of Sensitive Information into Log File em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log

CVE-2026-75056 Alta · 7.8 CWE-78 17/08/2026

OS Command Injection em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible

CVE-2026-75055 Média · 5.5 CWE-611 17/08/2026

XML External Entity (XXE) em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE

CVE-2026-75054 Média · 6.3 CWE-918 17/08/2026

Server-Side Request Forgery (SSRF) em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects

CVE-2026-75053 Média · 5.4 CWE-918 17/08/2026

Server-Side Request Forgery (SSRF) em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint

CVE-2026-75052 Média · 4.4 CWE-77 17/08/2026

Command Injection em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects

CVE-2026-64815 Crítica · 9.8 CWE-94 23/07/2026

Code Injection em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

CVE-2026-64814 Alta · 8.6 CWE-862 23/07/2026

Missing Authorization em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

CVE-2026-64813 Crítica · 10.0 CWE-602 23/07/2026

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible…

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session

CVE-2026-64812 Crítica · 10.0 CWE-306 23/07/2026

Missing Authentication for Critical Function em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

CVE-2026-64811 Alta · 7.8 CWE-829 23/07/2026

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before…

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration

CVE-2026-64810 Média · 6.1 CWE-79 23/07/2026

Cross-site Scripting (XSS) em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking

CVE-2026-59792 Crítica · 9.8 CWE-23 10/07/2026

Relative Path Traversal em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

CVE-2026-49383 Baixa · 3.3 CWE-611 29/05/2026

XML External Entity (XXE) em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

CVE-2026-49382 Alta · 7.8 CWE-1336 29/05/2026

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template…

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin

CVE-2026-49367 Alta · 8.8 CWE-862 29/05/2026

Missing Authorization em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

CVE-2026-49366 Alta · 7.8 CWE-78 29/05/2026

OS Command Injection em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion

CVE-2026-41882 Alta · 7.5 CWE-59 30/04/2026

Link Following em Jetbrains Intellij Idea

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server