Executive brief
JetBrains IntelliJ IDEA is a widely-used integrated development environment for Java and other languages. The Markdown export feature contained a vulnerability that could allow an attacker to execute arbitrary code on a developer's workstation when exporting documentation to Markdown format. This could lead to compromise of source code, credentials, and intellectual property stored on the developer's machine.
Technical details
A remote code execution vulnerability exists in the Markdown export functionality of JetBrains IntelliJ IDEA prior to version 2026.2.1. The vulnerability allows execution of arbitrary code through the export tool, likely via improper sanitization or deserialization of malicious content embedded in project files or documentation. An attacker could craft a malicious project or document that, when exported to Markdown format, triggers code execution with the privileges of the IDE user. The vulnerability has been patched in IntelliJ IDEA 2026.2.1 and later versions.
Affected products
- JetBrains IntelliJ IDEA before 2026.2.1
Timeline
- 2026-08-17: disclosed