CVE-2026-123304: High severity vulnerability

Published Nov 6, 2026

Updated

In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade JetBrains IntelliJ IDEA to a version that resolves this vulnerability.
Fixed in 2026.3

Event History

Nov 6, 2026

CVE Published

via MITRE·10:27 AM

Data Sourced

via MITRE·10:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of JetBrains IntelliJ IDEA versions before 2026.3 are affected when opening untrusted projects in an environment with a configured ShellCheck path.

What does exploitation require?

The attack requires local access and user interaction with an untrusted project. The CVSS vector indicates no privileges are required by the attacker, but the user must perform an action.

How can I determine whether a system may be affected?

Check whether IntelliJ IDEA is earlier than version 2026.3 and whether a ShellCheck path is configured. Systems meeting both conditions should be treated as potentially affected when untrusted projects are opened.

CVE-2026-123304: High severity vulnerability

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does exploitation require?

How can I determine whether a system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does exploitation require?

How can I determine whether a system may be affected?