SB2026100224 - Inclusion of Functionality from Untrusted Control Sphere in IntelliJ IDEA

Description

This security bulletin contains information about 1 vulnerability.

1) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2026-100256)

CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to inclusion of functionality from an untrusted control sphere in Structural Search script constraints when opening an untrusted project. A remote attacker can supply an untrusted project containing Structural Search script constraints to execute arbitrary code.

Remediation

Install update from vendor's website.

References

• https://www.jetbrains.com/privacy-security/issues-fixed/#b8bd59472549eff8820dedbf354f8026
• https://www.jetbrains.com/privacy-security/issues-fixed/#93cce2208caec15f82fa7077ef611f38