CVE-2026-123304 · Package
NO FIX YET · SEE WHAT TO DO
In JetBrains IntelliJ IDEA before 2026.3, a project can configure a ShellCheck path that the IDE executes, so opening an untrusted project can run code on the developer's machine. An attacker who supplies a malicious project gets code execution as the developer's user.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Developers who open projects from untrusted sources in IntelliJ IDEA versions before 2026.3 are exposed, because a configured ShellCheck path runs when the project is opened. Teams that only open their own trusted repositories have lower exposure but should still update. Whether the flaw needs a user action beyond opening the project is unknown.
Not affected if trusted-projects-only, version-2026.3-or-later
Who cares developer-tools, intellij-idea, jetbrains
idea --version where the CLI launcher is installed.2026.3 on developer machines.2026.3 or later (fixed version per the description).In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.