Low · 3.1 CVE-2026-123314 EUVD-2026-118078GHSA-8w4j-6jq4-r2fj

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request

Published Nov 6, 2026 · Updated Nov 6, 2026 · Assigned by JetBrains

Description

In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 xXE attack was possible via an XML response to an HTTP Client request

Vendor	Product	Affected	Fixed
JetBrains	IntelliJ IDEA	< 2026.3, 2026.2.4	2026.3, 2026.2.4