Server‑Side Request Forgery via DevKit Debug Listener in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint

Server‑side request forgery via OpenAPI preview proxy in JetBrains IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects

XXE Local File Disclosure in IntelliJ IDEA Hadoop ResourceManager

In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE

Remote Code Execution via Markdown Export Tool in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers

Local Command Execution via Crafted Markdown Preview in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects

In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

Unauthorized Input Injection in IntelliJ IDEA Remote Development

In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session

In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session

In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

Path Traversal in IntelliJ IDEA Enables Code Execution

In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible

Template Injection in IntelliJ IDEA Copyright Plugin Enables Code Execution

In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin

Command Injection via Filename Completion in JetBrains IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion

XML External Entity Vulnerability in JetBrains IntelliJ IDEA UI Designer

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

Arbitrary Local File Access via Built‑in Web Server in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server

In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start

In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH