CVE-2026-123302PATCHED

jetbrains · intellij idea

CVE-2026-123302: In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted p

Description

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script engine discovery

Affected Products

Vendor	Product	Versions
jetbrains	intellij idea	0

Also Affects

Downstream vendors/products affected by this vulnerability

Vendor	Product	Source	Confidence
jetbrains	intellij idea	cert_advisory	90%

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Related News (2 articles)

Tier B

BSI Advisories12h ago

[NEU] [hoch] JetBrains IntelliJ IDEA: Mehrere Schwachstellen

→ No new info (linked only)

Tier C

VulDB15h ago

CVE-2026-123302 | JetBrains IntelliJ IDEA prior 2026.3/2026.2.4/2026.1.5.1/2025.3.6.2 Script Engine code injection

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.17.8 HIGH

VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA KEV❌ No

Actively exploited❌ No

Patch available

2026.32026.2.42026.1.5.12025.3.6.2

CWECWE-829

PublishedNov 6, 2026

Last enriched14h agov2

Trending Score42

Source articles3

Independent2

Info Completeness10/14

Missing: epss, kev, exploit, iocs

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-123327

CVE-2026-123327: In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue

Trending: 47

HIGHCVE-2026-123325

CVE-2026-123325: In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible

Trending: 42

HIGHCVE-2026-123305

CVE-2026-123305: In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote

Trending: 42

HIGHCVE-2026-123304

CVE-2026-123304: In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

Trending: 42

HIGHCVE-2026-123276

CVE-2026-123276: In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug pr

Trending: 42

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Nov 6, 2026

Discovered by ZDM

Nov 6, 2026

Updated: description, cweIds, mitreAttack

Nov 6, 2026

Patch Available

Nov 6, 2026

Version History

Last enriched 14h ago

v2Tier C14h ago

Added CWE-94 (code injection), clarified attack vector as local via Script Engine component manipulation, and added MITRE ATT&CK technique T1059.001.

descriptioncweIdsmitreAttack

via VulDB

v115h ago

Initial creation