Vulnerabilities

TI-2026-85855 CVE-2026-123314 · GHSA-8w4j-6jq4-r2fj

XML external entity flaw in JetBrains IntelliJ IDEA HTTP Client

LOW 15

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.00221 Published 2026-11-06 Fixed in 2026.3, 2026.2.4 CWE-611

TI-2026-85853 CVE-2026-123312 · GHSA-24gf-pfrx-x3gp

LOW 15

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.00115 Published 2026-11-06 Fixed in 2026.3, 2026.2.4 CWE-827

TI-2026-85852 CVE-2026-123311 · GHSA-3vff-55hr-vh4w

LOW 25

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible

CVSS 3.1MEDIUM 5.3 Local No auth User interaction EPSS 0.00141 Published 2026-11-06 Fixed in 2026.3, 2026.2.4 CWE-1021

TI-2026-85850 CVE-2026-123309 · GHSA-4rqw-p72p-2m5j

LOW 27

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0023 Published 2026-11-06 Fixed in 2026.3, 2026.2.4 CWE-79

TI-2026-85848 CVE-2026-123307 · GHSA-32c5-4pwr-9g5v

LOW 32

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible

CVSS 3.1MEDIUM 6.8 Network No auth User interaction EPSS 0.00273 Published 2026-11-06 Fixed in 2026.3, 2026.2.4 CWE-918

TI-2026-85835 CVE-2026-123293 · GHSA-w8g5-wpr6-jpc4

LOW 35

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.0019 Published 2026-11-06 Fixed in 2026.3, 2026.2.4 CWE-829