{"id":"CVE-2026-123840","kind":"vulnerability","aliases":["CVE-2026-123840"],"related":[],"title":"JetBrains IntelliJ IDEA: HTML injection in Remote Development editor tabs","description":"In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs","summary":"In JetBrains IntelliJ IDEA before 2026.3, HTML could be injected into Remote Development editor tabs. The sources do not say what an attacker gains beyond altering the displayed content.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["intellij-idea","jetbrains","package","remote-development"],"not_affected_if":["version-2026.3-or-later"],"how_to_check":"- Check the IntelliJ IDEA version in Help > About; `2026.3` or later is not affected.","fix":"- IntelliJ IDEA: move to `2026.3` or later (per the sources' affected range before 2026.3).","status":"open","published_at":"2026-11-06T17:17:22+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:45:33+00:00","updated_at":"2026-11-06T17:45:33+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T17:45:33Z","model":"claude-haiku-5-5","output":{"fix":"- IntelliJ IDEA: move to `2026.3` or later (per the sources' affected range before 2026.3).","reach":"unknown","title":"JetBrains IntelliJ IDEA: HTML injection in Remote Development editor tabs","impact":"low","summary":"In JetBrains IntelliJ IDEA before 2026.3, HTML could be injected into Remote Development editor tabs. The sources do not say what an attacker gains beyond altering the displayed content.","audience":"developers","category":"package","nicknames":[],"who_cares":["intellij-idea","jetbrains","remote-development"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"unknown; injected HTML is rendered in editor tabs","analyst_note":"","how_to_check":"- Check the IntelliJ IDEA version in Help > About; `2026.3` or later is not affected.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["version-2026.3-or-later"],"who_is_affected":"Developers using IntelliJ IDEA Remote Development (remote editor tabs) on versions before 2026.3. The sources do not say what data or actions an attacker could reach, and whether an attacker needs to supply content or sit on a path to the user is unknown.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000663,"input_tokens":4172,"output_tokens":491,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123840':13A,16A '-2026':12A,15A '2026.3':30B,59C 'alter':50B 'attack':47B 'beyond':49B 'content':53B 'could':32B 'cve':11A,14A 'develop':8A,24B,37B,66C 'display':52B 'editor':9A,38B,67C 'gain':48B 'html':4A,31B,60C 'idea':3A,19B,28B,57C 'inject':5A,34B,61C 'intellij':2A,18B,27B,56C 'intellij-idea':17B 'jetbrain':1A,20B,26B,55C 'packag':21B 'possibl':63C 'remot':7A,23B,36B,65C 'remote-develop':22B 'say':44B 'sourc':41B 'tab':10A,39B,68C","nicknames":[],"mitigations":[],"who_affected":"Developers using IntelliJ IDEA Remote Development (remote editor tabs) on versions before 2026.3. The sources do not say what data or actions an attacker could reach, and whether an attacker needs to supply content or sit on a path to the user is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["intellijidea","jetbrains","medium","package","remotedevelopment"],"campaign_type":null,"search_a":"'-123840':13A,16A '-2026':12A,15A 'cve':11A,14A 'develop':8A 'editor':9A 'html':4A 'idea':3A 'inject':5A 'intellij':2A 'jetbrain':1A 'remot':7A 'tab':10A","search_b":"'2026.3':30B 'alter':50B 'attack':47B 'beyond':49B 'content':53B 'could':32B 'develop':24B,37B 'display':52B 'editor':38B 'gain':48B 'html':31B 'idea':19B,28B 'inject':34B 'intellij':18B,27B 'intellij-idea':17B 'jetbrain':20B,26B 'packag':21B 'remot':23B,36B 'remote-develop':22B 'say':44B 'sourc':41B 'tab':39B","search_c":"'2026.3':59C 'develop':66C 'editor':67C 'html':60C 'idea':57C 'inject':61C 'intellij':56C 'jetbrain':55C 'possibl':63C 'remot':65C 'tab':68C","first_public_at":"2026-11-06T17:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123840","severity":null,"published_at":"2026-11-06T17:17:22+00:00","modified_at":"2026-11-06T17:17:22+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}