Executive brief
JetBrains IntelliJ IDEA is a widely-used integrated development environment for Java and other languages. A flaw in the Markdown preview feature allowed arbitrary command execution through specially crafted Markdown content, but only in projects explicitly marked as trusted by the user, limiting the attack surface. Developers who opened untrusted projects with malicious Markdown files could unknowingly execute arbitrary code on their system.
Technical details
The vulnerability is a command execution flaw in IntelliJ IDEA's Markdown preview renderer. The root cause involves insufficient validation of content in Markdown preview that can be rendered when processing trusted projects. An attacker can craft malicious Markdown content that, when previewed, triggers command execution on the developer's machine. The attack requires a developer to open a project marked as trusted and then preview attacker-controlled Markdown files. The vulnerability affects IntelliJ IDEA versions before 2026.2.1 and is fixed in that release and later versions.
Affected products
- JetBrains IntelliJ IDEA before 2026.2.1
Timeline
- 2026-08-17: disclosed
- 2026-02-01: patched: Fixed in version 2026.2.1