{"id":"CVE-2026-123847","kind":"vulnerability","aliases":["CVE-2026-123847"],"related":[],"title":"JetBrains IntelliJ IDEA: terminal completion lets control characters run commands","description":"In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion","summary":"Before IntelliJ IDEA 2026.3, control characters in terminal command completion could cause command execution. An attacker who can supply crafted completion input may get a command run on the developer's machine.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-tools","intellij-idea","jetbrains","package"],"not_affected_if":["version-2026.3-or-later"],"how_to_check":"- Check the IDE version under Help > About in IntelliJ IDEA; versions before `2026.3` are listed as affected.","fix":"- IntelliJ IDEA: move to `2026.3` or later (the sources name this version as the first fixed release).","status":"open","published_at":"2026-11-06T17:17:23+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:45:32+00:00","updated_at":"2026-11-06T17:45:32+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T17:45:32Z","model":"claude-haiku-5-5","output":{"fix":"- IntelliJ IDEA: move to `2026.3` or later (the sources name this version as the first fixed release).","reach":"unknown","title":"JetBrains IntelliJ IDEA: terminal completion lets control characters run commands","impact":"medium","summary":"Before IntelliJ IDEA 2026.3, control characters in terminal command completion could cause command execution. An attacker who can supply crafted completion input may get a command run on the developer's machine.","audience":"developers","category":"package","nicknames":[],"who_cares":["intellij-idea","jetbrains","developer-tools"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Commands may run on the developer's machine through terminal completion","analyst_note":"Check the JetBrains issue or release notes for the exact trigger, the required input, and whether a default configuration is affected.","how_to_check":"- Check the IDE version under Help > About in IntelliJ IDEA; versions before `2026.3` are listed as affected.","plain_action":"","needs_analyst":true,"not_affected_if":["version-2026.3-or-later"],"who_is_affected":"Developers running IntelliJ IDEA versions before 2026.3 who use the integrated terminal and its command completion. The sources do not say what input an attacker needs to supply or whether a default setup is affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00067,"input_tokens":4167,"output_tokens":506,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123847':13A,16A '-2026':12A,15A '2026.3':28B,62C 'attack':40B 'caus':36B 'charact':8A,30B,69C 'command':10A,33B,37B,50B,63C,72C 'complet':5A,34B,45B,73C 'control':7A,29B,68C 'could':35B 'craft':44B 'cve':11A,14A 'develop':18B,54B 'developer-tool':17B 'execut':38B,64C 'get':48B 'idea':3A,22B,27B,60C 'input':46B 'intellij':2A,21B,26B,59C 'intellij-idea':20B 'jetbrain':1A,23B,58C 'let':6A 'machin':56B 'may':47B 'packag':24B 'possibl':66C 'run':9A,51B 'suppli':43B 'termin':4A,32B,71C 'tool':19B 'via':67C","nicknames":[],"mitigations":[],"who_affected":"Developers running IntelliJ IDEA versions before 2026.3 who use the integrated terminal and its command completion. The sources do not say what input an attacker needs to supply or whether a default setup is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developertools","intellijidea","jetbrains","medium","package"],"campaign_type":null,"search_a":"'-123847':13A,16A '-2026':12A,15A 'charact':8A 'command':10A 'complet':5A 'control':7A 'cve':11A,14A 'idea':3A 'intellij':2A 'jetbrain':1A 'let':6A 'run':9A 'termin':4A","search_b":"'2026.3':28B 'attack':40B 'caus':36B 'charact':30B 'command':33B,37B,50B 'complet':34B,45B 'control':29B 'could':35B 'craft':44B 'develop':18B,54B 'developer-tool':17B 'execut':38B 'get':48B 'idea':22B,27B 'input':46B 'intellij':21B,26B 'intellij-idea':20B 'jetbrain':23B 'machin':56B 'may':47B 'packag':24B 'run':51B 'suppli':43B 'termin':32B 'tool':19B","search_c":"'2026.3':62C 'charact':69C 'command':63C,72C 'complet':73C 'control':68C 'execut':64C 'idea':60C 'intellij':59C 'jetbrain':58C 'possibl':66C 'termin':71C 'via':67C","first_public_at":"2026-11-06T17:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123847","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123847","severity":null,"published_at":"2026-11-06T17:17:23+00:00","modified_at":"2026-11-06T17:17:23+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}