Medium · 6.1 CVE-2026-123309 EUVD-2026-118073GHSA-4rqw-p72p-2m5j

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview

Published Nov 6, 2026 · Updated Nov 6, 2026 · Assigned by JetBrains

Description

In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 stored XSS was possible on the built-in web server via Markdown preview

Vendor	Product	Affected	Fixed
JetBrains	IntelliJ IDEA	< 2026.3, 2026.2.4	2026.3, 2026.2.4