IntelliJ IDEA vulnerabilities

In JetBrains IntelliJ IDEA before 2026.2, unauthorized settings modification was possible in a Remote Development session.

In JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2, a vulnerability allowed code execution via path traversal in project workspace ID handling.

In IntelliJ IDEA before version 2026.2, there is a vulnerability allowing unauthorized file access during a Remote Development session. An attacker can access files they should not have permission to.

In JetBrains IntelliJ IDEA before 2026.1, the UI Designer form parser is vulnerable to XXE (XML External Entity) attacks.