---
id: "CVE-2026-123293"
page: "https://infrastack.ai/live/CVE-2026-123293"
kind: "vulnerability"
aliases: ["CVE-2026-123293"]
title: "JetBrains IntelliJ IDEA: untrusted projects can run code via Terraform path"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["developer-workstation", "intellij-idea", "jetbrains", "package", "terraform"]
not_affected_if: ["trusted-projects-only", "up-to-date-ide"]
published_at: "2026-11-06T11:17:08+00:00"
first_seen_at: "2026-11-06T11:41:25+00:00"
updated_at: "2026-11-06T11:42:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123293", "first_seen_at": "2026-11-06T11:41:25+00:00"}]
exploit_sources: []
---

# JetBrains IntelliJ IDEA: untrusted projects can run code via Terraform path

Link for people: https://infrastack.ai/live/CVE-2026-123293 (this .md is for agents)

In JetBrains IntelliJ IDEA before 2026.3 and 2026.2.4, opening an untrusted project could execute code through the Terraform tool path setting. An attacker who supplies a project can get code to run on the developer's machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the IDE version under Help > About in IntelliJ IDEA; affected builds are before `2026.3` and before `2026.2.4`.
- Look for the Terraform tool path setting in the project configuration and whether the project was opened in trust mode.

## Fix

- IntelliJ IDEA: move to `2026.3` or `2026.2.4`.

## Timeline

- 2026-11-06T11:41:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123293

## From the sources

In JetBrains IntelliJ IDEA before 2026.3, 
2026.2.4 code execution was possible in untrusted projects  via the Terraform tool path setting

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_