Threats affecting pkg:maven/com.jetbrains/intellij.idea

CVE-2026-100256 is a high-severity vulnerability in JetBrains IntelliJ IDEA before version 2026.2.3. It allows remote code execution (rCE) via Structural Search script constraints when working with untrusted projects. The vulnerability is identified as CWE-829, which relates to inclusion of functionality from untrusted control spheres. No official patch information is provided in the input data.

CVE-2026-49382 is a medium severity vulnerability in JetBrains IntelliJ IDEA before version 2026.1. It involves code execution via template injection in the Copyright plugin. The vulnerability has a CVSS 3.1 base score of 4.5, indicating limited impact with high attack complexity and required user interaction. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.

CVE-2026-49366 is a high-severity command injection vulnerability in JetBrains IntelliJ IDEA versions before 2026.1.1. The issue arises from unsafe handling of filename completion, allowing an attacker with local access and user interaction to execute arbitrary commands. This vulnerability impacts confidentiality, integrity, and availability of the affected system. No official patch or remediation guidance has been confirmed yet from the vendor. There are no known exploits in the wild at this time.