Log in Request a demo

Vulnerability

JetBrains IntelliJ IDEA Command Injection in Untrusted Projects (CVE-2026-123837)

A command injection flaw in JetBrains IntelliJ IDEA's Tomcat run configurations on Windows Subsystem for Linux (WSL).

CVE ID
CVE-2026-123837
CVSS
7.8 High (CVSS v3.1, JetBrains as CNA); no CVSS 4.0 score in the record or NVD
Affected product
IntelliJ IDEA, before 2026.3 and before 2026.2.1
Exploited
No
Published
6 November 2026 (CVE record and NVD)

In short

CVE-2026-123837 is a command injection flaw in JetBrains IntelliJ IDEA's Tomcat run configurations on Windows Subsystem for Linux (WSL). The CVE record says command injection was possible in untrusted projects before IntelliJ IDEA 2026.3 and 2026.2.1. JetBrains, the CNA, scores it CVSS 3.1 7.8 High, and its own fixed issues page credits the flaw as issue IDEA-389279.

Profile MapVulnerability
  1. CVECVE-2026-123837
  2. ProductJetBrains IntelliJ IDEA, before 2026.3 and before 2026.2.1
  3. Fix Steps4actions listedUpdate to 2026.3 or 2026.2.1

What it allows

CVE-2026-123837 is a gap in how IntelliJ IDEA handles Tomcat run configurations on WSL. The IDE loads project-level run configurations from files inside a project, including ones for untrusted projects a developer has not marked as trusted.

What Is CVE-2026-123837 and Who Is Exposed?

The CVE record attributes the flaw to CWE-78, OS command injection. JetBrains' own fixed issues page lists it as "command injection was possible in untrusted projects via Tomcat run configurations on WSL" and tracks it as issue IDEA-389279.

The CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. That vector needs a developer to open the project locally and interact with it, and it needs no account privileges. A successful run affects confidentiality, integrity and availability, all at the High level.

We read "untrusted projects" as IntelliJ IDEA's own term for a project a developer has opened but not marked as trusted, such as one cloned from an unfamiliar repository. The record does not say whether IntelliJ IDEA's Safe Mode blocks this specific flaw, unlike some other IntelliJ IDEA fixes published the same day.

How the Score Reads

JetBrains, the CNA, scores CVE-2026-123837 CVSS 3.1 7.8 High. There is no CVSS 4.0 score in the record or NVD. NVD listed the entry as Received on 6 November 2026, meaning NVD has not yet published its own analysis.

What JetBrains and CISA KEV Say

JetBrains' fixed issues page lists the severity as High and names 2026.3 and 2026.2.1 as the versions that resolve it. CISA's SSVC entry in the record (Vulnrichment, 6 November 2026) sets exploitation to none, automatable to no, and technical impact to total. The CVE is not in the CISA KEV catalogue, version 2026.11.04.

Who is affected

The CVE record lists IntelliJ IDEA before 2026.3 and before 2026.2.1 as affected. JetBrains' fixed issues page names the same two versions as the ones that resolve CVE-2026-123837.

JetBrains ships IntelliJ IDEA on a frequent release cycle, and 2026.2.1 is a point release on the 2026.2 branch rather than the newer 2026.3 line. Teams who stay on 2026.2 for compatibility reasons can take the 2026.2.1 point update without moving to 2026.3.

See the Command and Scripting Interpreter technique in our MITRE ATT&CK library for how this class of flaw is used after an attacker gets a foothold. Our CMS and developer tool vulnerability archive lists other recent developer tool flaws.

Timeline

  1. 6 Nov 2026

    JetBrains submits CVE-2026-123837 as the CNA, and NVD publishes its own entry the same day, listed as Received.

What to do

  1. Update to 2026.3 or 2026.2.1

    Move affected installs to IntelliJ IDEA 2026.3 or the 2026.2.1 point release, the two versions JetBrains' fixed issues page names for CVE-2026-123837.

  2. Review Untrusted Projects Before Running Them

    We recommend checking a project's run configurations, including any Tomcat configuration, before running or debugging an untrusted or newly cloned project.

  3. Track Which Developers Run IntelliJ IDEA on WSL

    List developers who run IntelliJ IDEA through Windows Subsystem for Linux, since the CVE record names WSL as the path for this specific flaw.

  4. Watch for Later JetBrains Advisories

    JetBrains published this fix alongside many other IntelliJ IDEA issues on 6 November 2026; check its fixed issues page again if new related CVE ids appear.

Questions

Which IntelliJ IDEA versions fix CVE-2026-123837?

IntelliJ IDEA 2026.3 and the 2026.2.1 point release, per JetBrains' own fixed issues page and the CVE record.

Does CVE-2026-123837 need an attacker to have an account?

No account is needed. The CVSS 3.1 vector lists privileges required as none, but it does need a developer to open the project and interact with it.

Is CVE-2026-123837 in the CISA KEV catalogue?

It is not in catalogue version 2026.11.04. CISA's SSVC entry for the CVE sets exploitation to none.

What does the record say about IntelliJ IDEA's Safe Mode?

The record does not say whether Safe Mode blocks this specific flaw; it describes the issue only as affecting untrusted projects.

Sources

  1. CVE-2026-123837 Record CVE Program / JetBrains
  2. CVE-2026-123837 NVD
  3. Fixed Security Issues JetBrains
  4. Known Exploited Vulnerabilities Catalog CISA

Last updated 6 November 2026

Browse the threat library

Keep exploring

Knowledge Hub

Technique

Command and Scripting Interpreter

Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs.

Read more