CVE-2026-123302: High severity vulnerability

Published Nov 6, 2026

Updated

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery

Event History

Nov 6, 2026

CVE Published

via MITRE·10:27 AM

Data Sourced

via MITRE·10:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

IntelliJ IDEA versions before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2 are affected.

What does an attacker need to exploit this issue?

Exploitation requires a user to interact with an untrusted project. The vulnerability can then allow code execution through script engine discovery, without requiring attacker privileges.

What should teams do?

Update IntelliJ IDEA to 2026.3, 2026.2.4, 2026.1.5.1, or 2025.3.6.2, as applicable. Until updating, avoid opening or interacting with projects from untrusted sources.

CVE-2026-123302: High severity vulnerability

Event History

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What should teams do?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What does an attacker need to exploit this issue?

What should teams do?