JetBrains IntelliJ IDEA: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 15

• High 8.2
  CVE-2026-123301

  In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• High 7.8
  CVE-2026-123293

  In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform …

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• High 7.8
  CVE-2026-123302

  In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted pro…

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• High 7.8
  CVE-2026-123304

  In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• High 7.5
  CVE-2026-123305

  In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote…

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• High 7.4
  CVE-2026-123306

  In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store dur…

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Medium 6.8
  CVE-2026-123307

  In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configuratio…

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Medium 6.7
  CVE-2026-123278

  In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Medium 6.3
  CVE-2026-123308

  In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Medium 6.1
  CVE-2026-123309

  In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown prev…

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Medium 5.4
  CVE-2026-123310

  In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories …

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Medium 5.3
  CVE-2026-123311

  In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview w…

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Low 3.3
  CVE-2026-123312

  In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Low 3.3
  CVE-2026-123313

  In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Low 3.1
  CVE-2026-123314

  In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request

  JetBrains IntelliJ IDEA
  Nov 6, 2026

Revision history

1. 2026-11-08 #2

   Referenz(en) aufgenommen: EUVD-2026-118072

2. 2026-11-05 #1

   Initiale Fassung

References

• JetBrains Privacy & Security Issues Fixed vom 2026-11-05
  https://www.jetbrains.com/privacy-security/issues-fixed/
• National Vulnerability Database CVE-2026-123278 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123278
• National Vulnerability Database CVE-2026-123293 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123293
• National Vulnerability Database CVE-2026-123301 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123301
• National Vulnerability Database CVE-2026-123302 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123302
• National Vulnerability Database CVE-2026-123304 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123304
• National Vulnerability Database CVE-2026-123305 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123305
• National Vulnerability Database CVE-2026-123306 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123306
• National Vulnerability Database CVE-2026-123307 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123307
• National Vulnerability Database CVE-2026-123308 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123308
• National Vulnerability Database CVE-2026-123309 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123309
• National Vulnerability Database CVE-2026-123310 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123310
• National Vulnerability Database CVE-2026-123311 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123311
• National Vulnerability Database CVE-2026-123312 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123312
• National Vulnerability Database CVE-2026-123313 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123313
• National Vulnerability Database CVE-2026-123314 vom 2026-11-05
  https://nvd.nist.gov/vuln/detail/CVE-2026-123314