High · 7.8 CVE-2026-123837 EUVD-2026-118340GHSA-f6xc-hpj3-cp3j

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL

Published Nov 6, 2026 · Updated Nov 7, 2026 · Assigned by JetBrains

Description

In JetBrains IntelliJ IDEA before 2026.3,
2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL

Vendor	Product	Affected	Fixed
JetBrains	IntelliJ IDEA	< 2026.3, 2026.2.1	2026.3, 2026.2.1