In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects
Users of JetBrains IntelliJ IDEA versions before 2026.3 may be exposed when handling document imports in untrusted projects. The issue requires local access and user interaction.
An attacker would need to cause a user to interact with a relevant document import in an untrusted project. The published vector indicates no privileges are required, but exploitation has high attack complexity.
Successful exploitation can result in code execution with high confidentiality and integrity impact. The published vector does not indicate an availability impact.