Executive brief
IntelliJ IDEA is a popular software development environment used by engineers to write and manage code. A security flaw allowed malicious code to run automatically when a user opened a project containing a specially crafted development container configuration, even before the user explicitly granted 'trust' to the project. This could allow an attacker to gain full control over a developer's workstation if they are tricked into opening a malicious project folder.
Technical details
A vulnerability classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) exists in JetBrains IntelliJ IDEA versions prior to 2026.2. The issue stems from the IDE processing development container (devcontainer) configurations and executing associated functionality before the 'Project Trust' security boundary is established. An attacker can exploit this by providing a malicious project that, when opened, executes arbitrary commands on the local system with the privileges of the IDE user. This requires local access to the files (e.g., via a downloaded repository) and user interaction to open the project. The issue is resolved in version 2026.2.
Affected products
- JetBrains IntelliJ IDEA before 2026.2
Timeline
- 2026-07-23: advisory: NVD publication date
- 2026-07-23: disclosed: Initial disclosure by JetBrains