Inclusion of Functionality from Untrusted Control Sphere in IntelliJ IDEA - CVE-2026-123308
Published: November 6, 2026
Vulnerability identifier: #VU159674
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-123308
CWE-ID: CWE-829
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to inclusion of functionality from an untrusted control sphere in the document import feature of IntelliJ IDEA when importing documents in untrusted projects. A remote attacker can supply malicious content in an untrusted project to execute arbitrary code during document import.
Affected software
IntelliJ IDEA
How to mitigate CVE-2026-123308
Install security update from vendor's website.
IntelliJ IDEA - update to 2026.3