Executive brief
A vulnerability in the JetBrains IntelliJ IDEA development environment could allow for unauthorized code execution. This issue exists within the Copyright plugin, which manages legal notices in software projects. If exploited, an attacker could potentially run malicious commands on a developer's machine, though this requires specific user interaction and complex conditions to be met.
Technical details
A Server-Side Template Injection (SSTI) vulnerability (CWE-1336) exists in the Copyright plugin of JetBrains IntelliJ IDEA versions prior to 2026.1. The flaw allows for improper neutralization of special elements used in the template engine, leading to potential arbitrary code execution. The attack vector is local and requires high complexity (AC:H) and user interaction (UI:R), suggesting that a victim might need to import or interact with a specially crafted project or copyright template. JetBrains has addressed this issue in version 2026.1.
Affected products
- JetBrains IntelliJ IDEA before 2026.1
Timeline
- 2026-05-29: advisory: CVE-2026-49382 published by JetBrains s.r.o.
- 2026-05-29: patched: Fixed in version 2026.1