---
id: "CVE-2026-123302"
page: "https://infrastack.ai/live/CVE-2026-123302"
kind: "vulnerability"
aliases: ["CVE-2026-123302"]
title: "IntelliJ IDEA: untrusted projects can run code via script engine discovery"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["intellij-idea", "java", "jetbrains", "kotlin", "runtime"]
not_affected_if: ["only-trusted-projects", "version-at-or-above-fixed"]
published_at: "2026-11-06T11:17:09+00:00"
first_seen_at: "2026-11-06T11:41:25+00:00"
updated_at: "2026-11-06T11:41:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123302", "first_seen_at": "2026-11-06T11:41:25+00:00"}]
exploit_sources: []
---

# IntelliJ IDEA: untrusted projects can run code via script engine discovery

Link for people: https://infrastack.ai/live/CVE-2026-123302 (this .md is for agents)

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1 and 2025.3.6.2, opening an untrusted project could execute code through script engine discovery. An attacker who gets a developer to open a crafted project can run code as that developer.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the IntelliJ IDEA version under Help > About and compare it with the fixed versions `2026.3`, `2026.2.4`, `2026.1.5.1`, `2025.3.6.2`
- Projects opened from untrusted sources are the exposure path; unknown whether any other setting changes it

## Fix

- Upgrade IntelliJ IDEA to `2026.3`, `2026.2.4`, `2026.1.5.1` or `2025.3.6.2`, matching your release line

## Timeline

- 2026-11-06T11:41:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123302

## From the sources

In JetBrains IntelliJ IDEA before 2026.3, 
2026.2.4, 
2026.1.5.1, 
2025.3.6.2 code execution was possible in untrusted projects via script engine discovery

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_