Executive brief
IntelliJ IDEA is a popular integrated development environment (IDE) used by software developers. A vulnerability in the UI Designer component could allow a malicious actor to read local files or internal network resources if a user is tricked into opening a specially crafted project file. This could lead to the unauthorized disclosure of sensitive information from the developer's workstation.
Technical details
An XML External Entity (XXE) vulnerability (CWE-611) exists in the UI Designer form parser of JetBrains IntelliJ IDEA. The root cause is improper restriction of XML external entity references when processing UI form files. An attacker can exploit this by providing a malicious project or form file that, when opened by a user, triggers the parser to resolve external entities. This can lead to local file disclosure or server-side request forgery (SSRF) targeting the local machine or internal network. The vulnerability is fixed in version 2026.1.
Affected products
- JetBrains IntelliJ IDEA before 2026.1
Timeline
- 2026-05-29: advisory: CVE-2026-49383 published by JetBrains
- 2026-05-29: patched: Fixed in version 2026.1