---
id: "CVE-2026-123840"
page: "https://infrastack.ai/live/CVE-2026-123840"
kind: "vulnerability"
aliases: ["CVE-2026-123840"]
title: "JetBrains IntelliJ IDEA: HTML injection in Remote Development editor tabs"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["intellij-idea", "jetbrains", "package", "remote-development"]
not_affected_if: ["version-2026.3-or-later"]
published_at: "2026-11-06T17:17:22+00:00"
first_seen_at: "2026-11-06T17:43:13+00:00"
updated_at: "2026-11-06T17:45:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123840", "first_seen_at": "2026-11-06T17:43:13+00:00"}]
exploit_sources: []
---

# JetBrains IntelliJ IDEA: HTML injection in Remote Development editor tabs

Link for people: https://infrastack.ai/live/CVE-2026-123840 (this .md is for agents)

In JetBrains IntelliJ IDEA before 2026.3, HTML could be injected into Remote Development editor tabs. The sources do not say what an attacker gains beyond altering the displayed content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the IntelliJ IDEA version in Help > About; `2026.3` or later is not affected.

## Fix

- IntelliJ IDEA: move to `2026.3` or later (per the sources' affected range before 2026.3).

## Timeline

- 2026-11-06T17:43:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123840

## From the sources

In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_