JetBrains IntelliJ IDEA
64 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-118697 | < 2026.2.4 | In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised interme | CRITICAL 9.0 | 0.3 % | ||
| CVE-2026-118696 | 2026.2 – < 2026.2.4 ; 2026.1 – < 2026.1.5.1 ; < 2025.3.6.2 | In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026 | HIGH 8.0 | 0.3 % | ||
| CVE-2026-100256 | < 2026.2.3 | In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects | HIGH 7.8 | 0.1 % | ||
| CVE-2026-86505 | < 2026.2.2 | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace | LOW 3.3 | 0.2 % | ||
| CVE-2026-86504 | < 2026.2.2 | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execut | HIGH 7.8 | 0.2 % | ||
| CVE-2026-86503 | < 2026.2.2 | In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching | LOW 3.3 | 0.1 % | ||
| CVE-2026-86502 | < 2026.2.2 | In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote De | HIGH 8.4 | 0.2 % | ||
| CVE-2026-86501 | < 2026.2.2 | In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log | LOW 2.8 | 0.4 % | ||
| CVE-2026-75058 | < 2026.2.1 | In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-75057 | < 2026.1.5 | In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log | MEDIUM 6.2 | 0.2 % | ||
| CVE-2026-75056 | < 2026.2.1 | In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible | HIGH 7.8 | 0.2 % | ||
| CVE-2026-75055 | < 2026.2.1 | In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE | MEDIUM 5.5 | 0.2 % | ||
| CVE-2026-75054 | < 2026.2.1 | In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-75053 | < 2026.2.1 | In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-75052 | < 2026.2.1 | In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects | MEDIUM 4.4 | 0.2 % | ||
| CVE-2026-64815 | < 2026.2 | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-64814 | < 2026.2 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session | HIGH 8.6 | 0.4 % | ||
| CVE-2026-64813 | < 2026.2 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session | CRITICAL 10.0 | 0.5 % | ||
| CVE-2026-64812 | < 2026.2 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session | CRITICAL 10.0 | 0.5 % | ||
| CVE-2026-64811 | < 2026.2 | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container confi | HIGH 7.8 | 0.2 % | ||
| CVE-2026-64810 | < 2026.2 | In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking | MEDIUM 6.1 | 0.3 % | ||
| CVE-2026-59792 | < 2026.1.4,
2026.2 | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-49383 | < 2026.1 | In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible | LOW 3.3 | 0.1 % | ||
| CVE-2026-49382 | < 2026.1 | In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin | HIGH 7.8 | 0.1 % | ||
| CVE-2026-49367 | < 2026.1.1 | In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account | HIGH 8.8 | 0.3 % | ||
| CVE-2026-49366 | < 2026.1.1 | In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion | HIGH 7.8 | 0.5 % | ||
| CVE-2026-41882 | < 2024.3.7.1,
2025.1.7.1,
2025.2.6.2,
2025.3.4.1,
2026.1.1 | In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible vi | HIGH 7.5 | 0.4 % | ||
| CVE-2025-68269 | < 2025.3 | In JetBrains IntelliJ IDEA before 2025.3 missing confirmation allowed opening of untrusted remote projects over SSH | MEDIUM 5.4 | 0.1 % | ||
| CVE-2025-57730 | < 2025.2 | In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature | MEDIUM 5.2 | 0.4 % | ||
| CVE-2025-57729 | < 2025.2 | In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start | HIGH 7.3 | 0.1 % | ||
| CVE-2025-57728 | < 2025.2 | In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files | MEDIUM 6.5 | 0.2 % | ||
| CVE-2025-57727 | < 2025.2 | In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference | HIGH 7.5 | 0.2 % | ||
| CVE-2025-32054 | < 2024.3, 2024.2.4 | In JetBrains IntelliJ IDEA before 2024.3, 2024.2.4 source code could be logged in the idea.log file | LOW 3.3 | 0.4 % | ||
| CVE-2024-46970 | < 2024.1 | In JetBrains IntelliJ IDEA before 2024.1 hTML injection via the project name was possible | MEDIUM 6.1 | 0.4 % | ||
| CVE-2024-37051 | 2023.1 – < 2023.1.7 ; 2023.1 – < 2023.2.7 ; 2023.1 – < 2023.3.7 ; … | GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023 | CRITICAL 9.3 | 4.9 % | ||
| CVE-2024-24941 | < 2023.3.3 | In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URL | MEDIUM 6.1 | 0.3 % | ||
| CVE-2024-24940 | < 2023.3.3 | In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives | MEDIUM 4.3 | 0.3 % | ||
| CVE-2023-51655 | < 2023.3.2 | In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified | CRITICAL 9.8 | 0.3 % | ||
| CVE-2023-39261 | < 2023.2 | In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions | HIGH 7.8 | 0.3 % | ||
| CVE-2023-38069 | < 2023.1.4 | In JetBrains IntelliJ IDEA before 2023.1.4 license dialog could be suppressed in certain cases | LOW 3.3 | 0.2 % | ||
| CVE-2022-48433 | < 2023.1 | In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server. | HIGH 7.5 | 0.6 % | ||
| CVE-2022-48432 | < 2023.1 | In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed. | HIGH 8.8 | 0.2 % | ||
| CVE-2022-48431 | < 2023.1 | In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation | HIGH 7.8 | 0.1 % | ||
| CVE-2022-48430 | < 2023.1 | In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview. | HIGH 7.5 | 0.3 % | ||
| CVE-2022-47896 | < 2022.3.1 | In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. | HIGH 7.8 | 0.3 % | ||
| CVE-2022-47895 | < 2022.3.1 | In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files. | HIGH 7.5 | 0.2 % | ||
| CVE-2022-46828 | < 2022.3 | In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible. | HIGH 7.8 | 0.3 % | ||
| CVE-2022-46827 | < 2022.3 | In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible. | MEDIUM 5.5 | 0.2 % | ||
| CVE-2022-46826 | < 2022.3 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnera | MEDIUM 6.2 | 0.2 % | ||
| CVE-2022-46825 | < 2022.3 | In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects. | MEDIUM 4.0 | 0.1 % | ||
| CVE-2022-46824 | < 2022.2.4 | In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible. | HIGH 7.8 | 0.2 % | ||
| CVE-2022-40978 | 2022.2.2 – < 2022.2.2 | The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking | HIGH 7.8 | 0.3 % | ||
| CVE-2022-37010 | 2022.2 – < 2022.2 | In JetBrains IntelliJ IDEA before 2022.2 email address validation in the "Git User Name Is Not Defined" dialog was missed | LOW 3.6 | 0.2 % | ||
| CVE-2022-37009 | 2022.2 – < 2022.2 | In JetBrains IntelliJ IDEA before 2022.2 local code execution via a Vagrant executable was possible | HIGH 7.8 | 0.3 % | ||
| CVE-2022-29819 | 2022.1 – < 2022.1 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible | HIGH 7.7 | 0.2 % | ||
| CVE-2022-29818 | 2022.1 – < 2022.1 | In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed | HIGH 7.1 | 0.1 % | ||
| CVE-2022-29817 | 2022.1 – < 2022.1 | In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible | MEDIUM 6.1 | 0.4 % | ||
| CVE-2022-29816 | 2022.1 – < 2022.1 | In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible | LOW 3.2 | 0.3 % | ||
| CVE-2022-29815 | 2022.1 – < 2022.1 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible | MEDIUM 6.9 | 0.2 % | ||
| CVE-2022-29814 | 2022.1 – < 2022.1 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible | HIGH 7.7 | 0.2 % | ||
| CVE-2022-29813 | 2022.1 – < 2022.1 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible | MEDIUM 6.9 | 0.2 % | ||
| CVE-2022-29812 | 2022.1 – < 2022.1 | In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient | LOW 2.3 | 0.2 % | ||
| CVE-2022-28651 | 2021.3.3 – < 2021.3.3 | In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields | HIGH 8.4 | 0.3 % | ||
| CVE-2017-8316 | <173 | IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malic | HIGH 7.5 | 2.3 % |