CVE-2026-123837: OS Command Injection

Published Nov 6, 2026

Updated

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade JetBrains IntelliJ IDEA to a version that resolves this vulnerability.
Fixed in 2026.3

Event History

Nov 6, 2026

CVE Published

via MITRE·04:10 PM

Data Sourced

via MITRE·04:10 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which usage scenario is exposed to this issue?

The issue is limited to untrusted projects that use Tomcat run configurations on WSL. The provided information does not indicate that other run-configuration types or non-WSL environments are affected.

CVE-2026-123837: OS Command Injection

Remediation

Event History

Frequently Asked Questions

Which usage scenario is exposed to this issue?

Company

Resources

Contact

Frequently Asked Questions

Which usage scenario is exposed to this issue?