{"id":"CVE-2026-123302","kind":"vulnerability","aliases":["CVE-2026-123302"],"related":[],"title":"IntelliJ IDEA: untrusted projects can run code via script engine discovery","description":"In JetBrains IntelliJ IDEA before 2026.3, \n2026.2.4, \n2026.1.5.1, \n2025.3.6.2 code execution was possible in untrusted projects via script engine discovery","summary":"In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1 and 2025.3.6.2, opening an untrusted project could execute code through script engine discovery. An attacker who gets a developer to open a crafted project can run code as that developer.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["intellij-idea","java","jetbrains","kotlin","runtime"],"not_affected_if":["only-trusted-projects","version-at-or-above-fixed"],"how_to_check":"- Check the IntelliJ IDEA version under Help > About and compare it with the fixed versions `2026.3`, `2026.2.4`, `2026.1.5.1`, `2025.3.6.2`\n- Projects opened from untrusted sources are the exposure path; unknown whether any other setting changes it","fix":"- Upgrade IntelliJ IDEA to `2026.3`, `2026.2.4`, `2026.1.5.1` or `2025.3.6.2`, matching your release line","status":"open","published_at":"2026-11-06T11:17:09+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","triaged_at":"2026-11-06T11:41:58+00:00","updated_at":"2026-11-06T11:41:58+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T11:41:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade IntelliJ IDEA to `2026.3`, `2026.2.4`, `2026.1.5.1` or `2025.3.6.2`, matching your release line","reach":"local","title":"IntelliJ IDEA: untrusted projects can run code via script engine discovery","impact":"high","summary":"In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1 and 2025.3.6.2, opening an untrusted project could execute code through script engine discovery. An attacker who gets a developer to open a crafted project can run code as that developer.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["intellij-idea","jetbrains","java","kotlin"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"code runs as the developer on their workstation","analyst_note":"Confirm the exact trigger and whether trust settings change exposure, using the JetBrains advisory for CVE-2026-123302.","how_to_check":"- Check the IntelliJ IDEA version under Help > About and compare it with the fixed versions `2026.3`, `2026.2.4`, `2026.1.5.1`, `2025.3.6.2`\n- Projects opened from untrusted sources are the exposure path; unknown whether any other setting changes it","plain_action":"","needs_analyst":true,"not_affected_if":["only-trusted-projects","version-at-or-above-fixed"],"who_is_affected":"Developers who open projects from untrusted sources (cloned repositories, attachments, shared archives) in IntelliJ IDEA. Teams that only open their own trusted projects are at lower risk, but the sources do not say this is safe.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000741,"input_tokens":4224,"output_tokens":637,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123302':14A,17A '-2026':13A,16A '2025.3.6.2':34B,71C '2026.1.5.1':32B,70C '2026.2.4':31B,69C '2026.3':30B,68C 'attack':47B 'code':7A,41B,59B,72C 'could':39B 'craft':55B 'cve':12A,15A 'develop':51B,62B 'discoveri':11A,45B,82C 'engin':10A,44B,81C 'execut':40B,73C 'get':49B 'idea':2A,20B,28B,66C 'intellij':1A,19B,27B,65C 'intellij-idea':18B 'java':21B 'jetbrain':22B,26B,64C 'kotlin':23B 'open':35B,53B 'possibl':75C 'project':4A,38B,56B,78C 'run':6A,58B 'runtim':24B 'script':9A,43B,80C 'untrust':3A,37B,77C 'via':8A,79C","nicknames":[],"mitigations":[],"who_affected":"Developers who open projects from untrusted sources (cloned repositories, attachments, shared archives) in IntelliJ IDEA. Teams that only open their own trusted projects are at lower risk, but the sources do not say this is safe.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","intellijidea","java","jetbrains","kotlin","runtime"],"campaign_type":null,"search_a":"'-123302':14A,17A '-2026':13A,16A 'code':7A 'cve':12A,15A 'discoveri':11A 'engin':10A 'idea':2A 'intellij':1A 'project':4A 'run':6A 'script':9A 'untrust':3A 'via':8A","search_b":"'2025.3.6.2':34B '2026.1.5.1':32B '2026.2.4':31B '2026.3':30B 'attack':47B 'code':41B,59B 'could':39B 'craft':55B 'develop':51B,62B 'discoveri':45B 'engin':44B 'execut':40B 'get':49B 'idea':20B,28B 'intellij':19B,27B 'intellij-idea':18B 'java':21B 'jetbrain':22B,26B 'kotlin':23B 'open':35B,53B 'project':38B,56B 'run':58B 'runtim':24B 'script':43B 'untrust':37B","search_c":"'2025.3.6.2':71C '2026.1.5.1':70C '2026.2.4':69C '2026.3':68C 'code':72C 'discoveri':82C 'engin':81C 'execut':73C 'idea':66C 'intellij':65C 'jetbrain':64C 'possibl':75C 'project':78C 'script':80C 'untrust':77C 'via':79C","first_public_at":"2026-11-06T11:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123302","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123302","severity":null,"published_at":"2026-11-06T11:17:09+00:00","modified_at":"2026-11-06T11:17:09+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","fetched_at":"2026-11-06T11:41:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}