{"id":"CVE-2026-123301","kind":"vulnerability","aliases":["CVE-2026-123301"],"related":[],"title":"JetBrains IntelliJ IDEA: DOM-based XSS in OpenAPI preview error view","description":"In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible","summary":"IntelliJ IDEA before 2026.3 has a DOM-based cross-site scripting flaw in the OpenAPI preview error view. An attacker who gets a developer to open a crafted OpenAPI file or preview could run script in the IDE's preview context.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["intellij-idea","jetbrains","openapi","other"],"not_affected_if":["version-2026.3-or-later"],"how_to_check":"- Check the IntelliJ IDEA version under Help > About; versions before `2026.3` are in the affected range.\n- Check whether the OpenAPI preview feature is in use on the machine.","fix":"- IntelliJ IDEA: move to `2026.3` or later.","status":"open","published_at":"2026-11-06T11:17:09+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","triaged_at":"2026-11-06T11:41:54+00:00","updated_at":"2026-11-06T11:41:54+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T11:41:54Z","model":"claude-haiku-5-5","output":{"fix":"- IntelliJ IDEA: move to `2026.3` or later.","reach":"local","title":"JetBrains IntelliJ IDEA: DOM-based XSS in OpenAPI preview error view","impact":"medium","summary":"IntelliJ IDEA before 2026.3 has a DOM-based cross-site scripting flaw in the OpenAPI preview error view. An attacker who gets a developer to open a crafted OpenAPI file or preview could run script in the IDE's preview context.","audience":"developers","category":"other","nicknames":[],"who_cares":["intellij-idea","jetbrains","openapi"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"script runs in the IDE preview context, possibly reading project data","analyst_note":"Confirm the attack vector and whether a malicious spec file alone triggers it, using the NVD entry and the JetBrains advisory.","how_to_check":"- Check the IntelliJ IDEA version under Help > About; versions before `2026.3` are in the affected range.\n- Check whether the OpenAPI preview feature is in use on the machine.","plain_action":"","needs_analyst":true,"not_affected_if":["version-2026.3-or-later"],"who_is_affected":"Developers who use IntelliJ IDEA versions before 2026.3 and open OpenAPI specifications in the preview view. The sources do not say whether specific plugin or project configurations change exposure. unknown for any further scope.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000693,"input_tokens":4179,"output_tokens":550,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123301':15A,18A '-2026':14A,17A '2026.3':27B,72C 'attack':45B 'base':6A,32B,75C 'context':66B 'could':58B 'craft':53B 'cross':34B 'cross-sit':33B 'cve':13A,16A 'develop':49B 'dom':5A,31B,74C 'dom-bas':4A,30B,73C 'error':11A,42B,81C 'file':55B 'flaw':37B 'get':47B 'ide':63B 'idea':3A,21B,25B,70C 'intellij':2A,20B,24B,69C 'intellij-idea':19B 'jetbrain':1A,22B,68C 'open':51B 'openapi':9A,23B,40B,54B,79C 'possibl':84C 'preview':10A,41B,57B,65B,80C 'run':59B 'script':36B,60B 'site':35B 'view':12A,43B,82C 'xss':7A,76C","nicknames":[],"mitigations":[],"who_affected":"Developers who use IntelliJ IDEA versions before 2026.3 and open OpenAPI specifications in the preview view. The sources do not say whether specific plugin or project configurations change exposure. unknown for any further scope.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","intellijidea","jetbrains","openapi","other"],"campaign_type":null,"search_a":"'-123301':15A,18A '-2026':14A,17A 'base':6A 'cve':13A,16A 'dom':5A 'dom-bas':4A 'error':11A 'idea':3A 'intellij':2A 'jetbrain':1A 'openapi':9A 'preview':10A 'view':12A 'xss':7A","search_b":"'2026.3':27B 'attack':45B 'base':32B 'context':66B 'could':58B 'craft':53B 'cross':34B 'cross-sit':33B 'develop':49B 'dom':31B 'dom-bas':30B 'error':42B 'file':55B 'flaw':37B 'get':47B 'ide':63B 'idea':21B,25B 'intellij':20B,24B 'intellij-idea':19B 'jetbrain':22B 'open':51B 'openapi':23B,40B,54B 'preview':41B,57B,65B 'run':59B 'script':36B,60B 'site':35B 'view':43B","search_c":"'2026.3':72C 'base':75C 'dom':74C 'dom-bas':73C 'error':81C 'idea':70C 'intellij':69C 'jetbrain':68C 'openapi':79C 'possibl':84C 'preview':80C 'view':82C 'xss':76C","first_public_at":"2026-11-06T11:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123301","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123301","severity":null,"published_at":"2026-11-06T11:17:09+00:00","modified_at":"2026-11-06T11:17:09+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","fetched_at":"2026-11-06T11:41:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}