This vulnerability (CVE-2026-100256) in JetBrains IntelliJ IDEA allows remote code execution through Structural Search script constraints in untrusted projects. It is classified under CWE-829, which concerns the inclusion of functionality from untrusted control spheres. The flaw exists in all versions before 2026.2.3, enabling an attacker with local access and user interaction to execute arbitrary code with high impact on confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects the ease of exploitation with low attack complexity and no privileges required, but user interaction is necessary. JetBrains has published this vulnerability but no patch links are provided in the input data.

Successful exploitation of this vulnerability can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. The attacker can execute arbitrary code in the context of the user running IntelliJ IDEA, potentially leading to full system compromise. The vulnerability requires user interaction and local access but no privileges, making it a significant risk in environments where untrusted projects are opened.

A fix is available in JetBrains IntelliJ IDEA version 2026.2.3. Users should upgrade to this version or later to remediate the vulnerability. Since the vendor advisory content is not provided, patch status is inferred from the affectedVersions field indicating versions before 2026.2.3 are vulnerable. No additional mitigation guidance is available from the input data.