Command Injection through Untrusted Tomcat Run Configurations on WSL in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL

Remote Code Execution via UI Designer Form File in Safe Mode

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file

Unprompted URL Opening via Remote Development Port Forwarding

In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model

Code Execution via Terraform Tool Path Setting in IntelliJ IDEA Before 2026.3

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting

DOM‑based XSS via OpenAPI Preview Error View in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible

Code Execution via Script Engine Discovery in Untrusted Projects

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery

Execution via Malicious ShellCheck Path in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

Path Traversal via Unpacking Remote Dev Container Archives in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host

Insecure Server Certificate Addition During Headless IDE Runs

In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs

Unauthenticated External Connections via Run Configurations in IntelliJ IDEA

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible

Unauthenticated RMI Endpoint Enables Code Execution in JetBrains IntelliJ IDEA before 2026.3

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint

Code Execution via Untrusted Angular CLI Schematics Loader in WebStorm

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader

Insufficient Login Warning Enables Credential Leakage to Malicious Server in JetBrains Toolbox App

In JetBrains Toolbox App before 3.9 insufficient warning in the login dialog allowed connecting to a malicious server

Missing Domain Attribute Validation Allows Cookie Injection in JetBrains Ktor

In JetBrains Ktor before 3.6.1 missing Domain attribute validation in client cookie storage allowed cookie injection

Ktor CIO Engine HTTP Request Smuggling Vulnerability

In JetBrains Ktor before 3.6.1 hTTP request smuggling was possible in the CIO engine

Command Execution via Allow Similar Commands Option in JetBrains Junie CLI

In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation

PyCharm Safe Mode Code Execution via Jupyter Widget Module

In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module

Code Execution via Untrusted Grunt/Gulp Task Loading in WebStorm

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects

Session Forgery via Tampered Encrypted Cookies in JetBrains Ktor

In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies