CVE-2026-86504 describes a security vulnerability in JetBrains IntelliJ IDEA prior to version 2026.2.2. The issue arises from the absence of project-trust confirmation before initiating the build of a Dev Container. This lack of confirmation allows an attacker to execute code at the host level, potentially compromising the host system. The vulnerability is categorized under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The CVSS v3.1 base score is 7.8, indicating a high severity with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the host machine where IntelliJ IDEA is running. This can lead to full compromise of the host system, including unauthorized access, data modification, and denial of service.

A fix is available in JetBrains IntelliJ IDEA version 2026.2.2. Users should upgrade to this version or later to remediate the vulnerability. No additional mitigation steps are indicated in the provided data.