XML External Entity injection in IntelliJ IDEA - CVE-2026-123314
Published: November 6, 2026
Vulnerability identifier: #VU159684
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-123314
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to potentially disclose sensitive information through XML external entity injection.
The vulnerability exists due to improper restriction of XML external entity resolution in the IntelliJ IDEA HTTP Client when processing XML responses to HTTP requests. A remote attacker can supply a specially crafted XML response containing external entity references to potentially disclose sensitive information accessible to the application.
Affected software
IntelliJ IDEA
How to mitigate CVE-2026-123314
Install security update from vendor's website.
IntelliJ IDEA - addressed in versions 2026.2.4, 2026.3