Jetbrains Intellij Idea
56 CVEs affecting Jetbrains Intellij Idea. Latest disclosed: 2026-08-17. Critical: 4, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-64813 | Critical | 10.0 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session |
CVE-2026-64812 | Critical | 10.0 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session |
CVE-2026-59792 | Critical | 9.6 | 2026-07-10 | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible |
CVE-2024-37051 | Critical | 9.3 | 2024-06-10 | GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 202… |
CVE-2026-64814 | High | 8.6 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session |
CVE-2022-28651 | High | 8.4 | 2022-04-05 | In JetBrains IntelliJ IDEA before 2021.3.3 it was possible to get passwords from protected fields |
CVE-2026-64815 | High | 8.1 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files |
CVE-2026-49367 | High | 8.0 | 2026-05-29 | In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account |
CVE-2026-75056 | High | 7.8 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible |
CVE-2026-64811 | High | 7.8 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration |
CVE-2026-49366 | High | 7.8 | 2026-05-29 | In JetBrains IntelliJ IDEA before 2026.1.1 command injection was possible via filename completion |
CVE-2022-40978 | High | 7.5 | 2022-09-19 | The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking |
CVE-2017-8316 | High | 7.5 | 2018-08-03 | IntelliJ IDEA XML parser was found vulnerable to XML External Entity attack, an attacker can exploit the vulnerability by implementing malicious code on both A… |
CVE-2026-41882 | High | 7.4 | 2026-04-30 | In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web serv… |
CVE-2022-29819 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible |
CVE-2022-29815 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible |
CVE-2022-29814 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible |
CVE-2022-29813 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible |
CVE-2025-57729 | Medium | 6.5 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start |
CVE-2025-57728 | Medium | 6.5 | 2025-08-20 | In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files |