{"id":"CVE-2026-123310","kind":"vulnerability","aliases":["CVE-2026-123310"],"related":[],"title":"JetBrains IntelliJ IDEA: Kotlin scripts download dependencies from arbitrary repositories","description":"In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositories in untrusted projects","summary":"In JetBrains IntelliJ IDEA before 2026.3, Kotlin scripts could trigger dependency downloads from arbitrary repositories when a project is untrusted. An attacker who supplies a malicious project can make the IDE fetch artifacts from a server of their choosing.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-tools","intellij-idea","jetbrains","kotlin","other"],"not_affected_if":["trusted-projects-only"],"how_to_check":"- Check the IntelliJ IDEA version under Help > About; versions before `2026.3` are in the affected range.\n- Open projects from untrusted sources only after confirming the IDE is at `2026.3` or later.","fix":"- JetBrains IntelliJ IDEA: move to `2026.3` or later.","status":"open","published_at":"2026-11-06T11:17:10+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","triaged_at":"2026-11-06T11:42:31+00:00","updated_at":"2026-11-06T11:42:31+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T11:42:31Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains IntelliJ IDEA: move to `2026.3` or later.","reach":"local","title":"JetBrains IntelliJ IDEA: Kotlin scripts download dependencies from arbitrary repositories","impact":"medium","summary":"In JetBrains IntelliJ IDEA before 2026.3, Kotlin scripts could trigger dependency downloads from arbitrary repositories when a project is untrusted. An attacker who supplies a malicious project can make the IDE fetch artifacts from a server of their choosing.","audience":"developers","category":"other","nicknames":[],"who_cares":["intellij-idea","kotlin","jetbrains","developer-tools"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Untrusted project causes IDE to fetch dependencies from attacker servers","analyst_note":"Confirm the trust-prompt behaviour and whether default settings expose the flaw; check the JetBrains advisory for the exact scope.","how_to_check":"- Check the IntelliJ IDEA version under Help > About; versions before `2026.3` are in the affected range.\n- Open projects from untrusted sources only after confirming the IDE is at `2026.3` or later.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-projects-only"],"who_is_affected":"Developers who open untrusted projects in IntelliJ IDEA versions before 2026.3 that contain Kotlin scripts. Teams that only open their own trusted projects are less exposed, and the sources do not say whether default settings change the risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000716,"input_tokens":4191,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123310':13A,16A '-2026':12A,15A '2026.3':30B,69C 'arbitrari':9A,38B,77C 'artifact':57B 'attack':46B 'choos':63B 'could':33B,72C 'cve':11A,14A 'depend':7A,35B,74C 'develop':18B 'developer-tool':17B 'download':6A,36B,75C 'fetch':56B 'ide':55B 'idea':3A,22B,28B,67C 'intellij':2A,21B,27B,66C 'intellij-idea':20B 'jetbrain':1A,23B,26B,65C 'kotlin':4A,24B,31B,70C 'make':53B 'malici':50B 'project':42B,51B,81C 'repositori':10A,39B,78C 'script':5A,32B,71C 'server':60B 'suppli':48B 'tool':19B 'trigger':34B,73C 'untrust':44B,80C","nicknames":[],"mitigations":[],"who_affected":"Developers who open untrusted projects in IntelliJ IDEA versions before 2026.3 that contain Kotlin scripts. Teams that only open their own trusted projects are less exposed, and the sources do not say whether default settings change the risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developertools","intellijidea","jetbrains","kotlin","medium","other"],"campaign_type":null,"search_a":"'-123310':13A,16A '-2026':12A,15A 'arbitrari':9A 'cve':11A,14A 'depend':7A 'download':6A 'idea':3A 'intellij':2A 'jetbrain':1A 'kotlin':4A 'repositori':10A 'script':5A","search_b":"'2026.3':30B 'arbitrari':38B 'artifact':57B 'attack':46B 'choos':63B 'could':33B 'depend':35B 'develop':18B 'developer-tool':17B 'download':36B 'fetch':56B 'ide':55B 'idea':22B,28B 'intellij':21B,27B 'intellij-idea':20B 'jetbrain':23B,26B 'kotlin':24B,31B 'make':53B 'malici':50B 'project':42B,51B 'repositori':39B 'script':32B 'server':60B 'suppli':48B 'tool':19B 'trigger':34B 'untrust':44B","search_c":"'2026.3':69C 'arbitrari':77C 'could':72C 'depend':74C 'download':75C 'idea':67C 'intellij':66C 'jetbrain':65C 'kotlin':70C 'project':81C 'repositori':78C 'script':71C 'trigger':73C 'untrust':80C","first_public_at":"2026-11-06T11:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123310","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123310","severity":null,"published_at":"2026-11-06T11:17:10+00:00","modified_at":"2026-11-06T11:17:10+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","fetched_at":"2026-11-06T11:41:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}