This vulnerability (CVE-2026-49366) affects JetBrains IntelliJ IDEA prior to version 2026.1.1. It is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command), indicating a command injection flaw. The vulnerability occurs via filename completion functionality, which can be manipulated to execute arbitrary OS commands. The CVSS 3.1 base score is 7.8, reflecting high severity with local attack vector, low attack complexity, no privileges required, but requiring user interaction. The impact includes high confidentiality, integrity, and availability consequences. No patch or official remediation level has been provided by JetBrains as of the publication date.

Successful exploitation allows an attacker with local access and user interaction to execute arbitrary commands on the host system, potentially leading to full compromise including data disclosure, modification, or denial of service. The vulnerability affects the core functionality of IntelliJ IDEA, impacting developer environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with filename completion features and avoid untrusted input during such operations. Monitor JetBrains advisories for updates.