JetBrains IntelliJ IDEA before version 2026.1.1 contains a command injection vulnerability (CWE-78) that can be triggered through the filename completion feature. This allows an attacker with local access and user interaction to execute arbitrary commands with the privileges of the affected user. The vulnerability has a CVSS 3.1 base score of 7.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by JetBrains as of the publication date.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the affected system, potentially leading to full compromise of user data and system integrity. The CVSS vector indicates local attack vector with low complexity, no privileges required, but user interaction is necessary. The impact on confidentiality, integrity, and availability is high.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution with filename completion features and avoid interacting with untrusted inputs that could trigger this vulnerability.