{"id":"CVE-2026-123293","kind":"vulnerability","aliases":["CVE-2026-123293"],"related":[],"title":"JetBrains IntelliJ IDEA: untrusted projects can run code via Terraform path","description":"In JetBrains IntelliJ IDEA before 2026.3, \n2026.2.4 code execution was possible in untrusted projects  via the Terraform tool path setting","summary":"In JetBrains IntelliJ IDEA before 2026.3 and 2026.2.4, opening an untrusted project could execute code through the Terraform tool path setting. An attacker who supplies a project can get code to run on the developer's machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-workstation","intellij-idea","jetbrains","package","terraform"],"not_affected_if":["trusted-projects-only","up-to-date-ide"],"how_to_check":"- Check the IDE version under Help > About in IntelliJ IDEA; affected builds are before `2026.3` and before `2026.2.4`.\n- Look for the Terraform tool path setting in the project configuration and whether the project was opened in trust mode.","fix":"- IntelliJ IDEA: move to `2026.3` or `2026.2.4`.","status":"open","published_at":"2026-11-06T11:17:08+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","triaged_at":"2026-11-06T11:42:01+00:00","updated_at":"2026-11-06T11:42:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T11:42:01Z","model":"claude-haiku-5-5","output":{"fix":"- IntelliJ IDEA: move to `2026.3` or `2026.2.4`.","reach":"local","title":"JetBrains IntelliJ IDEA: untrusted projects can run code via Terraform path","impact":"high","summary":"In JetBrains IntelliJ IDEA before 2026.3 and 2026.2.4, opening an untrusted project could execute code through the Terraform tool path setting. An attacker who supplies a project can get code to run on the developer's machine.","audience":"developers","category":"package","nicknames":[],"who_cares":["intellij-idea","jetbrains","terraform","developer-workstation"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"code runs on the developer's workstation when a project is opened","analyst_note":"","how_to_check":"- Check the IDE version under Help > About in IntelliJ IDEA; affected builds are before `2026.3` and before `2026.2.4`.\n- Look for the Terraform tool path setting in the project configuration and whether the project was opened in trust mode.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-projects-only","up-to-date-ide"],"who_is_affected":"Developers who open projects they did not write, such as cloned repositories or contractor code, in affected IntelliJ IDEA builds. Exposure depends on opening an untrusted project with the Terraform tool path setting in play; developers who only open their own trusted projects are less exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4191,"output_tokens":549,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123293':14A,17A '-2026':13A,16A '2026.2.4':34B,70C '2026.3':32B,69C 'attack':49B 'code':8A,41B,56B,71C 'could':39B 'cve':12A,15A 'develop':19B,61B 'developer-workst':18B 'execut':40B,72C 'get':55B 'idea':3A,23B,30B,67C 'intellij':2A,22B,29B,66C 'intellij-idea':21B 'jetbrain':1A,24B,28B,65C 'machin':63B 'open':35B 'packag':25B 'path':11A,46B,82C 'possibl':74C 'project':5A,38B,53B,77C 'run':7A,58B 'set':47B,83C 'suppli':51B 'terraform':10A,26B,44B,80C 'tool':45B,81C 'untrust':4A,37B,76C 'via':9A,78C 'workstat':20B","nicknames":[],"mitigations":[],"who_affected":"Developers who open projects they did not write, such as cloned repositories or contractor code, in affected IntelliJ IDEA builds. Exposure depends on opening an untrusted project with the Terraform tool path setting in play; developers who only open their own trusted projects are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developerworkstation","high","intellijidea","jetbrains","package","terraform"],"campaign_type":null,"search_a":"'-123293':14A,17A '-2026':13A,16A 'code':8A 'cve':12A,15A 'idea':3A 'intellij':2A 'jetbrain':1A 'path':11A 'project':5A 'run':7A 'terraform':10A 'untrust':4A 'via':9A","search_b":"'2026.2.4':34B '2026.3':32B 'attack':49B 'code':41B,56B 'could':39B 'develop':19B,61B 'developer-workst':18B 'execut':40B 'get':55B 'idea':23B,30B 'intellij':22B,29B 'intellij-idea':21B 'jetbrain':24B,28B 'machin':63B 'open':35B 'packag':25B 'path':46B 'project':38B,53B 'run':58B 'set':47B 'suppli':51B 'terraform':26B,44B 'tool':45B 'untrust':37B 'workstat':20B","search_c":"'2026.2.4':70C '2026.3':69C 'code':71C 'execut':72C 'idea':67C 'intellij':66C 'jetbrain':65C 'path':82C 'possibl':74C 'project':77C 'set':83C 'terraform':80C 'tool':81C 'untrust':76C 'via':78C","first_public_at":"2026-11-06T11:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123293","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123293","severity":null,"published_at":"2026-11-06T11:17:08+00:00","modified_at":"2026-11-06T11:17:08+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","fetched_at":"2026-11-06T11:41:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}