In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projects
Users of JetBrains IntelliJ IDEA versions before 2026.3 are exposed when they open or interact with untrusted projects containing Kotlin scripts.
An attacker needs to craft an untrusted project with Kotlin scripts that cause dependency downloads from attacker-chosen repositories, and a user must interact with that project.
The issue can cause IntelliJ IDEA to initiate dependency downloads from arbitrary repositories. The supplied severity vector indicates low confidentiality and integrity impact, with no availability impact.
Update JetBrains IntelliJ IDEA to version 2026.3 or later. Until updating, avoid opening or interacting with untrusted projects that include Kotlin scripts.