JetBrains IntelliJ IDEA: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 15

• High 7.8
  CVE-2026-123837

  In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run …

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• High 7.8
  CVE-2026-123838

  In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• High 7.8
  CVE-2026-123841

  In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• High 7.8
  CVE-2026-123853

  In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM …

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• High 7.4
  CVE-2026-123848

  In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• High 7.1
  CVE-2026-123842

  In JetBrains IntelliJ IDEA before 2026.3 arbitrary file write was possible via symlinks when extracting plugin archives

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• High 7.0
  CVE-2026-123849

  In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watch…

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Medium 5.3
  CVE-2026-123844

  In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Medium 5.3
  CVE-2026-123847

  In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command comp…

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Medium 4.7
  CVE-2026-123839

  In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Develo…

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Medium 4.7
  CVE-2026-123840

  In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Medium 4.3
  CVE-2026-123846

  In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Low 3.6
  CVE-2026-123833

  In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Low 3.3
  CVE-2026-123843

  In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration

  JetBrains IntelliJ IDEA
  Nov 6, 2026
• Low 3.3
  CVE-2026-123845

  In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via JSON Schema references in untrusted projects

  JetBrains IntelliJ IDEA
  Nov 6, 2026

Revision history

1. 2026-11-08 #1

   Initiale Fassung

References

• JetBrains Fixed security issues vom 2026-11-08
  https://www.jetbrains.com/privacy-security/issues-fixed/
• National Vulnerability Database CVE-2026-123833 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123833
• National Vulnerability Database CVE-2026-123837 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123837
• National Vulnerability Database CVE-2026-123838 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123838
• National Vulnerability Database CVE-2026-123839 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123839
• National Vulnerability Database CVE-2026-123840 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123840
• National Vulnerability Database CVE-2026-123841 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123841
• National Vulnerability Database CVE-2026-123842 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123842
• National Vulnerability Database CVE-2026-123843 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123843
• National Vulnerability Database CVE-2026-123844 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123844
• National Vulnerability Database CVE-2026-123845 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123845
• National Vulnerability Database CVE-2026-123846 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123846
• National Vulnerability Database CVE-2026-123847 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123847
• National Vulnerability Database CVE-2026-123848 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123848
• National Vulnerability Database CVE-2026-123849 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123849
• National Vulnerability Database CVE-2026-123853 vom 2026-11-08
  https://nvd.nist.gov/vuln/detail/CVE-2026-123853