CVE-2026-123841 · Other
NO FIX YET · SEE WHAT TO DO
Importing a settings archive into JetBrains IntelliJ IDEA before 2026.3 could run code, because symlinks inside the archive were followed. An attacker who supplies a crafted settings archive can get code executed on the developer's machine.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Developers who run IntelliJ IDEA versions before 2026.3 and import settings archives, especially ones obtained from others. Teams that never import settings archives from untrusted sources have a much smaller exposure. The sources do not say whether managed or default-configured installs differ.
Not affected if no-settings-import, trusted-archives-only
Who cares developer-workstation, intellij-idea, jetbrains
idea --version where the launcher is on the PATH2026.3; anything earlier is listed as affected2026.3 or laterIn JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.