{"id":"CVE-2026-123849","kind":"vulnerability","aliases":["CVE-2026-123849"],"related":[],"title":"JetBrains IntelliJ IDEA: untrusted projects can run code via Terraform File Watchers","description":"In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers","summary":"Before IntelliJ IDEA 2026.3, opening an untrusted project could execute code through the Terraform File Watchers feature. An attacker who supplies a malicious project can run code on the developer's machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-workstation","intellij-idea","jetbrains","other","terraform"],"not_affected_if":["file-watchers-disabled","ide-version-2026.3-or-later","trusted-projects-only"],"how_to_check":"- Check the IntelliJ IDEA version under Help > About, or run `idea --version` if the launcher is on the PATH.\n- Confirm whether the Terraform plugin and its File Watchers are enabled in Settings > Plugins and Settings > Tools > File Watchers.","fix":"- JetBrains IntelliJ IDEA: move to `2026.3` or later.","status":"open","published_at":"2026-11-06T17:17:23+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:45:11+00:00","updated_at":"2026-11-06T17:45:11+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T17:45:11Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains IntelliJ IDEA: move to `2026.3` or later.","reach":"local","title":"JetBrains IntelliJ IDEA: untrusted projects can run code via Terraform File Watchers","impact":"high","summary":"Before IntelliJ IDEA 2026.3, opening an untrusted project could execute code through the Terraform File Watchers feature. An attacker who supplies a malicious project can run code on the developer's machine.","audience":"developers","category":"other","nicknames":[],"who_cares":["intellij-idea","jetbrains","terraform","developer-workstation"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"code runs on the developer's workstation when a project is opened","analyst_note":"Confirm the trigger (opening an untrusted project versus a specific File Watcher action) and whether File Watchers are on by default, using the JetBrains security advisory.","how_to_check":"- Check the IntelliJ IDEA version under Help > About, or run `idea --version` if the launcher is on the PATH.\n- Confirm whether the Terraform plugin and its File Watchers are enabled in Settings > Plugins and Settings > Tools > File Watchers.","plain_action":"","needs_analyst":true,"not_affected_if":["ide-version-2026.3-or-later","trusted-projects-only","file-watchers-disabled"],"who_is_affected":"Developers who open projects from untrusted sources in IntelliJ IDEA builds before 2026.3, particularly with Terraform File Watchers active. Teams that only open their own trusted repositories have less exposure. The sources do not give more detail on the exact trigger.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000725,"input_tokens":4178,"output_tokens":615,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123849':15A,18A '-2026':14A,17A '2026.3':31B,65C 'attack':46B 'code':8A,38B,54B,66C 'could':36B 'cve':13A,16A 'develop':20B,57B 'developer-workst':19B 'execut':37B,67C 'featur':44B 'file':11A,42B,76C 'idea':3A,24B,30B,63C 'intellij':2A,23B,29B,62C 'intellij-idea':22B 'jetbrain':1A,25B,61C 'machin':59B 'malici':50B 'open':32B 'possibl':69C 'project':5A,35B,51B,72C 'run':7A,53B 'suppli':48B 'terraform':10A,27B,41B,75C 'untrust':4A,34B,71C 'via':9A,73C 'watcher':12A,43B,77C 'workstat':21B","nicknames":[],"mitigations":[],"who_affected":"Developers who open projects from untrusted sources in IntelliJ IDEA builds before 2026.3, particularly with Terraform File Watchers active. Teams that only open their own trusted repositories have less exposure. The sources do not give more detail on the exact trigger.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developerworkstation","high","intellijidea","jetbrains","other","terraform"],"campaign_type":null,"search_a":"'-123849':15A,18A '-2026':14A,17A 'code':8A 'cve':13A,16A 'file':11A 'idea':3A 'intellij':2A 'jetbrain':1A 'project':5A 'run':7A 'terraform':10A 'untrust':4A 'via':9A 'watcher':12A","search_b":"'2026.3':31B 'attack':46B 'code':38B,54B 'could':36B 'develop':20B,57B 'developer-workst':19B 'execut':37B 'featur':44B 'file':42B 'idea':24B,30B 'intellij':23B,29B 'intellij-idea':22B 'jetbrain':25B 'machin':59B 'malici':50B 'open':32B 'project':35B,51B 'run':53B 'suppli':48B 'terraform':27B,41B 'untrust':34B 'watcher':43B 'workstat':21B","search_c":"'2026.3':65C 'code':66C 'execut':67C 'file':76C 'idea':63C 'intellij':62C 'jetbrain':61C 'possibl':69C 'project':72C 'terraform':75C 'untrust':71C 'via':73C 'watcher':77C","first_public_at":"2026-11-06T17:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123849","severity":null,"published_at":"2026-11-06T17:17:23+00:00","modified_at":"2026-11-06T17:17:23+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}