{"id":"CVE-2026-123853","kind":"vulnerability","aliases":["CVE-2026-123853"],"related":[],"title":"JetBrains IntelliJ IDEA: project files can run code in Safe Mode","description":"In JetBrains IntelliJ IDEA before 2026.3, \n2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process","summary":"Before IntelliJ IDEA 2026.3 and 2026.2.2, a project could control JVM options used by the build process, letting code run even when Safe Mode was active. An attacker who gets a developer to open a malicious project can run code on that developer's machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-workstation","intellij-idea","java","jetbrains","other"],"not_affected_if":["trusted-projects-only","up-to-date-ide"],"how_to_check":"- Open IntelliJ IDEA and check Help > About for the build number; compare it against the fixed versions below.","fix":"- IntelliJ IDEA: move to `2026.3` or `2026.2.2`, the first releases listed as fixed in the source.","status":"open","published_at":"2026-11-06T17:17:24+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:44:58+00:00","updated_at":"2026-11-06T17:44:58+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T17:44:58Z","model":"claude-haiku-5-5","output":{"fix":"- IntelliJ IDEA: move to `2026.3` or `2026.2.2`, the first releases listed as fixed in the source.","reach":"local","title":"JetBrains IntelliJ IDEA: project files can run code in Safe Mode","impact":"high","summary":"Before IntelliJ IDEA 2026.3 and 2026.2.2, a project could control JVM options used by the build process, letting code run even when Safe Mode was active. An attacker who gets a developer to open a malicious project can run code on that developer's machine.","audience":"developers","category":"other","nicknames":[],"who_cares":["intellij-idea","jetbrains","java","developer-workstation"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Code runs on the developer's workstation when a malicious project opens.","analyst_note":"Confirm the exact fixed versions and the trigger (opening a project) against the JetBrains advisory; the NVD entry gives only the description.","how_to_check":"- Open IntelliJ IDEA and check Help > About for the build number; compare it against the fixed versions below.\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-projects-only","up-to-date-ide"],"who_is_affected":"Developers who open untrusted or third-party projects in IntelliJ IDEA before the fixed versions, relying on Safe Mode for protection. Teams that only open their own trusted projects face less risk. unknown for whether build-only or runtime setups are affected beyond this.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000705,"input_tokens":4197,"output_tokens":571,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123853':14A,17A '-2026':13A,16A '2026.2.2':31B,77C '2026.3':29B,76C 'activ':51B 'attack':53B 'build':41B,93C 'code':8A,44B,65B,78C 'control':35B,88C 'could':34B 'cve':12A,15A 'develop':19B,57B,68B 'developer-workst':18B 'even':46B 'execut':79C 'file':5A 'get':55B 'idea':3A,23B,28B,74C 'intellij':2A,22B,27B,73C 'intellij-idea':21B 'java':24B 'jetbrain':1A,25B,72C 'jvm':36B,89C 'let':43B 'machin':70B 'malici':61B 'mode':11A,49B,84C 'open':59B 'option':37B,90C 'possibl':81C 'process':42B,94C 'project':4A,33B,62B,87C 'project-control':86C 'run':7A,45B,64B 'safe':10A,48B,83C 'use':38B 'via':85C 'workstat':20B","nicknames":[],"mitigations":[],"who_affected":"Developers who open untrusted or third-party projects in IntelliJ IDEA before the fixed versions, relying on Safe Mode for protection. Teams that only open their own trusted projects face less risk. unknown for whether build-only or runtime setups are affected beyond this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developerworkstation","high","intellijidea","java","jetbrains","other"],"campaign_type":null,"search_a":"'-123853':14A,17A '-2026':13A,16A 'code':8A 'cve':12A,15A 'file':5A 'idea':3A 'intellij':2A 'jetbrain':1A 'mode':11A 'project':4A 'run':7A 'safe':10A","search_b":"'2026.2.2':31B '2026.3':29B 'activ':51B 'attack':53B 'build':41B 'code':44B,65B 'control':35B 'could':34B 'develop':19B,57B,68B 'developer-workst':18B 'even':46B 'get':55B 'idea':23B,28B 'intellij':22B,27B 'intellij-idea':21B 'java':24B 'jetbrain':25B 'jvm':36B 'let':43B 'machin':70B 'malici':61B 'mode':49B 'open':59B 'option':37B 'process':42B 'project':33B,62B 'run':45B,64B 'safe':48B 'use':38B 'workstat':20B","search_c":"'2026.2.2':77C '2026.3':76C 'build':93C 'code':78C 'control':88C 'execut':79C 'idea':74C 'intellij':73C 'jetbrain':72C 'jvm':89C 'mode':84C 'option':90C 'possibl':81C 'process':94C 'project':87C 'project-control':86C 'safe':83C 'via':85C","first_public_at":"2026-11-06T17:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123853","severity":null,"published_at":"2026-11-06T17:17:24+00:00","modified_at":"2026-11-06T17:17:24+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}