{"id":"CVE-2026-123308","kind":"vulnerability","aliases":["CVE-2026-123308"],"related":[],"title":"JetBrains IntelliJ IDEA: document import runs code in untrusted projects","description":"In JetBrains IntelliJ IDEA before 2026.3 code execution via the document import was possible in untrusted projects","summary":"Before IntelliJ IDEA 2026.3, importing a document inside an untrusted project could execute code. An attacker who gets a developer to open a crafted project could run code on that developer's machine.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-tools","intellij-idea","jetbrains","other"],"not_affected_if":["trusted-projects-only","version-2026.3-or-later"],"how_to_check":"- Check the IntelliJ IDEA version under Help > About; anything below `2026.3` is in the stated range.\n- Look at whether the team opens projects from unknown or external sources in the IDE.","fix":"- IntelliJ IDEA: move to `2026.3` or later (per the NVD description, 'before 2026.3' is affected).","status":"open","published_at":"2026-11-06T11:17:09+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","triaged_at":"2026-11-06T11:42:20+00:00","updated_at":"2026-11-06T11:42:20+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T11:42:20Z","model":"claude-haiku-5-5","output":{"fix":"- IntelliJ IDEA: move to `2026.3` or later (per the NVD description, 'before 2026.3' is affected).","reach":"local","title":"JetBrains IntelliJ IDEA: document import runs code in untrusted projects","impact":"high","summary":"Before IntelliJ IDEA 2026.3, importing a document inside an untrusted project could execute code. An attacker who gets a developer to open a crafted project could run code on that developer's machine.","audience":"developers","category":"other","nicknames":[],"who_cares":["intellij-idea","jetbrains","developer-tools"],"confidence":0.5,"fix_status":"available","needs_auth":"no","worst_case":"code runs on the developer's machine via a crafted project","analyst_note":"Confirm the exact import trigger and whether the untrusted-project check is bypassed; check the JetBrains advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-123308 and the JetBrains release notes for 2026.3.","how_to_check":"- Check the IntelliJ IDEA version under Help > About; anything below `2026.3` is in the stated range.\n- Look at whether the team opens projects from unknown or external sources in the IDE.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-projects-only","version-2026.3-or-later"],"who_is_affected":"Developers who open untrusted or third-party projects in IntelliJ IDEA before 2026.3 are exposed through the document import path. Teams that only open their own trusted repositories have lower exposure. The sources do not give more detail on the exact import trigger.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4168,"output_tokens":600,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123308':13A,16A '-2026':12A,15A '2026.3':27B,62C 'attack':39B 'code':7A,37B,51B,63C 'could':35B,49B 'craft':47B 'cve':11A,14A 'develop':18B,43B,54B 'developer-tool':17B 'document':4A,30B,67C 'execut':36B,64C 'get':41B 'idea':3A,22B,26B,60C 'import':5A,28B,68C 'insid':31B 'intellij':2A,21B,25B,59C 'intellij-idea':20B 'jetbrain':1A,23B,58C 'machin':56B 'open':45B 'possibl':70C 'project':10A,34B,48B,73C 'run':6A,50B 'tool':19B 'untrust':9A,33B,72C 'via':65C","nicknames":[],"mitigations":[],"who_affected":"Developers who open untrusted or third-party projects in IntelliJ IDEA before 2026.3 are exposed through the document import path. Teams that only open their own trusted repositories have lower exposure. The sources do not give more detail on the exact import trigger.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developertools","intellijidea","jetbrains","medium","other"],"campaign_type":null,"search_a":"'-123308':13A,16A '-2026':12A,15A 'code':7A 'cve':11A,14A 'document':4A 'idea':3A 'import':5A 'intellij':2A 'jetbrain':1A 'project':10A 'run':6A 'untrust':9A","search_b":"'2026.3':27B 'attack':39B 'code':37B,51B 'could':35B,49B 'craft':47B 'develop':18B,43B,54B 'developer-tool':17B 'document':30B 'execut':36B 'get':41B 'idea':22B,26B 'import':28B 'insid':31B 'intellij':21B,25B 'intellij-idea':20B 'jetbrain':23B 'machin':56B 'open':45B 'project':34B,48B 'run':50B 'tool':19B 'untrust':33B","search_c":"'2026.3':62C 'code':63C 'document':67C 'execut':64C 'idea':60C 'import':68C 'intellij':59C 'jetbrain':58C 'possibl':70C 'project':73C 'untrust':72C 'via':65C","first_public_at":"2026-11-06T11:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123308","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123308","severity":null,"published_at":"2026-11-06T11:17:09+00:00","modified_at":"2026-11-06T11:17:09+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","fetched_at":"2026-11-06T11:41:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}