Executive brief
JetBrains IntelliJ IDEA is a popular integrated development environment (IDE) used by software developers to write and test code. A vulnerability in versions before 2026.2.2 allows an attacker to execute code on the host system at full privileges by crafting a malicious project that builds a Dev Container without first requiring the user to confirm they trust the project. This could lead to complete compromise of a developer's machine and any data or systems it can access.
Technical details
The vulnerability is a logic flaw in IntelliJ IDEA's project-trust mechanism for Dev Containers. When a Dev Container is built, the IDE fails to enforce a project-trust confirmation dialog before executing container build scripts. An attacker can exploit this by distributing a malicious project (e.g., via a Git repository or archive) that contains a Dev Container configuration. When a developer opens the project and triggers a build, arbitrary code embedded in the container definition executes on the host system with the IDE process privileges. The attack requires user interaction (opening the project and initiating the build) but no prior authentication. This flaw was fixed in IntelliJ IDEA version 2026.2.2 and later.
Affected products
- JetBrains IntelliJ IDEA before 2026.2.2
Timeline
- 2026-09-07: disclosed