SB20260907137 - Multiple vulnerabilities in IntelliJ IDEA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20260907137

SB20260907137 - Multiple vulnerabilities in IntelliJ IDEA

Published: September 7, 2026

Security Bulletin ID SB20260907137
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 40% Low 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-86505)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose project metadata to JetBrains Marketplace.

The vulnerability exists due to a missing project-trust check in IntelliJ IDEA when handling project metadata. A local user can cause IntelliJ IDEA to send project metadata to JetBrains Marketplace to disclose project metadata.


2) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2026-86504)

CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute code on the host system.

The vulnerability exists due to improper control of functionality from an untrusted control sphere in the Dev Container build process when building a Dev Container from an untrusted project. A remote attacker can build a Dev Container from an untrusted project to execute code on the host system.


3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-86503)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause server-side request forgery.

The vulnerability exists due to improper restriction of URL fetching in Kubernetes spec-source URL fetching when opening an untrusted project. A remote attacker can trick a victim into opening an untrusted project to cause server-side request forgery.


4) Missing Authentication for Critical Function (CVE-ID: CVE-2026-86502)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to missing authentication in the IJent gRPC server when handling gRPC requests. A remote attacker can connect to the unauthenticated server to execute arbitrary code.

The issue affects Remote Development hosts.


5) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-86501)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to insertion of sensitive information into log files in Terminal command input logging when handling terminal command input. A local user can cause terminal command input to be written to idea.log to disclose sensitive information.


Remediation

Install update from vendor's website.

References