{"id":"CVE-2026-123837","kind":"vulnerability","aliases":["CVE-2026-123837"],"related":[],"title":"JetBrains IntelliJ IDEA: untrusted projects can inject commands via Tomcat run configurations","description":"In JetBrains IntelliJ IDEA before 2026.3, \n2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL","summary":"In JetBrains IntelliJ IDEA before 2026.3 (and 2026.2.1), opening an untrusted project with a Tomcat run configuration on WSL allowed command injection. An attacker who supplies a project can get commands executed on the developer's machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["intellij-idea","java","jetbrains","package","tomcat","wsl"],"not_affected_if":["no-tomcat-run-configs","no-wsl","trusted-projects-only"],"how_to_check":"- Open IntelliJ IDEA and check Help > About for the build version, then compare against `2026.3` and `2026.2.1`.\n- Check whether you use Tomcat run configurations on WSL with projects from outside your team.","fix":"- JetBrains IntelliJ IDEA: move to `2026.3` or `2026.2.1`.","status":"open","published_at":"2026-11-06T17:17:22+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","triaged_at":"2026-11-06T17:44:58+00:00","updated_at":"2026-11-06T17:44:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T17:44:58Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains IntelliJ IDEA: move to `2026.3` or `2026.2.1`.","reach":"local","title":"JetBrains IntelliJ IDEA: untrusted projects can inject commands via Tomcat run configurations","impact":"high","summary":"In JetBrains IntelliJ IDEA before 2026.3 (and 2026.2.1), opening an untrusted project with a Tomcat run configuration on WSL allowed command injection. An attacker who supplies a project can get commands executed on the developer's machine.","audience":"developers","category":"package","nicknames":[],"who_cares":["intellij-idea","jetbrains","wsl","tomcat","java"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Commands run on the developer's machine when an untrusted project opens","analyst_note":"","how_to_check":"- Open IntelliJ IDEA and check Help > About for the build version, then compare against `2026.3` and `2026.2.1`.\n- Check whether you use Tomcat run configurations on WSL with projects from outside your team.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-projects-only","no-wsl","no-tomcat-run-configs"],"who_is_affected":"Developers who open projects they do not trust in IntelliJ IDEA on Windows Subsystem for Linux while using Tomcat run configurations. Teams that only open their own trusted projects, or that do not use WSL with Tomcat run configurations, are less exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4197,"output_tokens":569,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123837':15A,18A '-2026':14A,17A '2026.2.1':34B,70C '2026.3':32B,69C 'allow':46B 'attack':50B 'command':8A,47B,57B,71C 'configur':12A,43B,81C 'cve':13A,16A 'develop':61B 'execut':58B 'get':56B 'idea':3A,21B,30B,67C 'inject':7A,48B,72C 'intellij':2A,20B,29B,66C 'intellij-idea':19B 'java':22B 'jetbrain':1A,23B,28B,65C 'machin':63B 'open':35B 'packag':24B 'possibl':74C 'project':5A,38B,54B,77C 'run':11A,42B,80C 'suppli':52B 'tomcat':10A,25B,41B,79C 'untrust':4A,37B,76C 'via':9A,78C 'wsl':26B,45B,83C","nicknames":[],"mitigations":[],"who_affected":"Developers who open projects they do not trust in IntelliJ IDEA on Windows Subsystem for Linux while using Tomcat run configurations. Teams that only open their own trusted projects, or that do not use WSL with Tomcat run configurations, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","intellijidea","java","jetbrains","package","tomcat","wsl"],"campaign_type":null,"search_a":"'-123837':15A,18A '-2026':14A,17A 'command':8A 'configur':12A 'cve':13A,16A 'idea':3A 'inject':7A 'intellij':2A 'jetbrain':1A 'project':5A 'run':11A 'tomcat':10A 'untrust':4A 'via':9A","search_b":"'2026.2.1':34B '2026.3':32B 'allow':46B 'attack':50B 'command':47B,57B 'configur':43B 'develop':61B 'execut':58B 'get':56B 'idea':21B,30B 'inject':48B 'intellij':20B,29B 'intellij-idea':19B 'java':22B 'jetbrain':23B,28B 'machin':63B 'open':35B 'packag':24B 'project':38B,54B 'run':42B 'suppli':52B 'tomcat':25B,41B 'untrust':37B 'wsl':26B,45B","search_c":"'2026.2.1':70C '2026.3':69C 'command':71C 'configur':81C 'idea':67C 'inject':72C 'intellij':66C 'jetbrain':65C 'possibl':74C 'project':77C 'run':80C 'tomcat':79C 'untrust':76C 'via':78C 'wsl':83C","first_public_at":"2026-11-06T17:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123837","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123837","severity":null,"published_at":"2026-11-06T17:17:22+00:00","modified_at":"2026-11-06T17:17:22+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","fetched_at":"2026-11-06T17:43:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}