Threat database

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible

CVE-2026-123310 is a server-side request forgery (SSRF) vulnerability in JetBrains IntelliJ IDEA affecting versions before 2026.3. Kotlin scripts in untrusted projects could trigger dependency downloads from arbitrary repositories, potentially allowing attackers to induce the IDE to make unintended network requests. The issue is fixed in version 2026.3.

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview

In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible

In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs

In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host

In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery

A DOM-based Cross-site Scripting (XSS) vulnerability exists in JetBrains IntelliJ IDEA versions before 2026.3. The flaw occurs in the OpenAPI preview error view, allowing an attacker to execute arbitrary scripts in the context of the affected application. This vulnerability has been assigned CVE-2026-123301 and is rated high severity with a CVSS score of 8.2. The issue is fixed in version 2026.3.

In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings

In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible

In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible

In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow

In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting

In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid

In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook