{"id":"CVE-2026-123314","kind":"vulnerability","aliases":["CVE-2026-123314"],"related":[],"title":"JetBrains IntelliJ IDEA: XML response can trigger XXE file reads","description":"In JetBrains IntelliJ IDEA before 2026.3, \n2026.2.4 xXE attack was possible via an XML response to an HTTP Client request","summary":"Before JetBrains IntelliJ IDEA 2026.3 and 2026.2.4, an XML response handled by the built-in HTTP Client could trigger an XML external entity (XXE) attack. An attacker who controls the server the IDE queries could potentially read local files or reach internal resources.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developers","http-client","intellij-idea","jetbrains","package"],"not_affected_if":["fixed-version","no-untrusted-http-requests"],"how_to_check":"- Check the IntelliJ IDEA version under Help > About, or run `idea --version` where the launcher is available.\n- Compare against the fixed versions: before `2026.3` and before `2026.2.4` are affected.","fix":"- JetBrains IntelliJ IDEA: move to `2026.3` or `2026.2.4`.","status":"open","published_at":"2026-11-06T11:17:10+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","triaged_at":"2026-11-06T11:43:53+00:00","updated_at":"2026-11-06T11:43:53+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T11:43:53Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains IntelliJ IDEA: move to `2026.3` or `2026.2.4`.","reach":"network","title":"JetBrains IntelliJ IDEA: XML response can trigger XXE file reads","impact":"medium","summary":"Before JetBrains IntelliJ IDEA 2026.3 and 2026.2.4, an XML response handled by the built-in HTTP Client could trigger an XML external entity (XXE) attack. An attacker who controls the server the IDE queries could potentially read local files or reach internal resources.","audience":"developers","category":"package","nicknames":[],"who_cares":["intellij-idea","jetbrains","http-client","developers"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"local files may be read through injected XML entities","analyst_note":"Confirm the exact affected HTTP Client feature and whether the 2026.2.4 fix line applies to all 2026.2 builds, using the JetBrains release notes.","how_to_check":"- Check the IntelliJ IDEA version under Help > About, or run `idea --version` where the launcher is available.\n- Compare against the fixed versions: before `2026.3` and before `2026.2.4` are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["fixed-version","no-untrusted-http-requests"],"who_is_affected":"Developers using IntelliJ IDEA's HTTP Client to send requests to servers, especially ones that return XML. Exposure depends on the IDE being pointed at an untrusted or attacker-controlled endpoint. Teams that do not use the HTTP Client against untrusted hosts are at lower risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00073,"input_tokens":4194,"output_tokens":621,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123314':13A,16A '-2026':12A,15A '2026.2.4':32B,76C '2026.3':30B,75C 'attack':51B,53B,78C 'built':40B 'built-in':39B 'client':20B,43B,88C 'control':55B 'could':44B,61B 'cve':11A,14A 'develop':17B 'entiti':49B 'extern':48B 'file':9A,65B 'handl':36B 'http':19B,42B,87C 'http-client':18B 'ide':59B 'idea':3A,23B,29B,73C 'intellij':2A,22B,28B,72C 'intellij-idea':21B 'intern':68B 'jetbrain':1A,24B,27B,71C 'local':64B 'packag':25B 'possibl':80C 'potenti':62B 'queri':60B 'reach':67B 'read':10A,63B 'request':89C 'resourc':69B 'respons':5A,35B,84C 'server':57B 'trigger':7A,45B 'via':81C 'xml':4A,34B,47B,83C 'xxe':8A,50B,77C","nicknames":[],"mitigations":[],"who_affected":"Developers using IntelliJ IDEA's HTTP Client to send requests to servers, especially ones that return XML. Exposure depends on the IDE being pointed at an untrusted or attacker-controlled endpoint. Teams that do not use the HTTP Client against untrusted hosts are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developers","httpclient","intellijidea","jetbrains","low","package"],"campaign_type":null,"search_a":"'-123314':13A,16A '-2026':12A,15A 'cve':11A,14A 'file':9A 'idea':3A 'intellij':2A 'jetbrain':1A 'read':10A 'respons':5A 'trigger':7A 'xml':4A 'xxe':8A","search_b":"'2026.2.4':32B '2026.3':30B 'attack':51B,53B 'built':40B 'built-in':39B 'client':20B,43B 'control':55B 'could':44B,61B 'develop':17B 'entiti':49B 'extern':48B 'file':65B 'handl':36B 'http':19B,42B 'http-client':18B 'ide':59B 'idea':23B,29B 'intellij':22B,28B 'intellij-idea':21B 'intern':68B 'jetbrain':24B,27B 'local':64B 'packag':25B 'potenti':62B 'queri':60B 'reach':67B 'read':63B 'resourc':69B 'respons':35B 'server':57B 'trigger':45B 'xml':34B,47B 'xxe':50B","search_c":"'2026.2.4':76C '2026.3':75C 'attack':78C 'client':88C 'http':87C 'idea':73C 'intellij':72C 'jetbrain':71C 'possibl':80C 'request':89C 'respons':84C 'via':81C 'xml':83C 'xxe':77C","first_public_at":"2026-11-06T11:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123314","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123314","severity":null,"published_at":"2026-11-06T11:17:10+00:00","modified_at":"2026-11-06T11:17:10+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","fetched_at":"2026-11-06T11:41:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}