IntelliJ IDEA vulnerabilities

7 known vulnerabilities in IntelliJ IDEA from JetBrains. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  IntelliJ IDEA: Inclusion of Functionality from Untrusted Control Sphere

  CVE-2026-123302Nov 6, 2026JetBrains

  In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery

• 9.0 Critical severity

  Toolbox App: Improper Certificate Validation

  CVE-2026-118697Oct 30, 2026JetBrains

  In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand and Rider before 2026.3 and 2026.2.4; CLion before 2026.3 and 2026.2.4.1; DataGrip before 2026.3 and 2026.2.6.1; RustRover before 2026.3 and 2026.2.5,

• 8.0 High severity

  IntelliJ IDEA: Improper Check for Certificate Revocation

  CVE-2026-118696Oct 30, 2026JetBrains

  In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3

• 8.4 High severity

  IntelliJ IDEA: Missing Authentication for Critical Functionality

  CVE-2026-86502Sep 7, 2026JetBrains

  In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

• 7.5 High severity

  IntelliJ IDEA: Improper Link Resolution Before File Access

  CVE-2026-41882Apr 30, 2026JetBrains

  In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server

• 7.5 High severity

  IntelliJ IDEA: Insufficiently Protected Credentials

  CVE-2024-37051Jun 10, 2024JetBrainsEPSS 4.88%

  GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGri

• 9.8 Critical severity

  IntelliJ IDEA: Insufficient Verification of Data Authenticity

  CVE-2023-51655Dec 21, 2023JetBrains

  In JetBrains IntelliJ IDEA before 2023.3.2 code execution was possible in Untrusted Project mode via a malicious plugin repository specified in the project configuration