CVE-2026-123849 in IntelliJ IDEA
Summary
by MITRE • 11/06/2026
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in JetBrains IntelliJ IDEA prior to version 2026.3 represents a significant security risk for developers working with infrastructure-as-code, specifically within the Terraform ecosystem. This flaw stems from an improper restriction on command execution facilitated by the integrated Terraform File Watchers feature. In typical development workflows, file watchers are designed to monitor changes in specific files and trigger predefined actions or scripts automatically upon detection of those changes. While this functionality enhances productivity by automating tasks such as formatting, linting, or running tests, it introduces a potential attack vector if the underlying execution mechanism does not sufficiently validate the source or integrity of the project being monitored.
The core technical flaw lies in how IntelliJ IDEA handles untrusted projects when utilizing these file watchers for Terraform files. An attacker who gains access to an untrusted repository or can influence the content and structure of a Terraform configuration within such a project could craft malicious inputs that exploit this lack of validation. By manipulating specific attributes or configurations, it is possible to trigger arbitrary command execution on the host machine where the IDE is running. This effectively bypasses standard security boundaries because the vulnerability relies on the trust relationship between the integrated development environment and the code being edited, assuming that all opened projects are safe when in reality, developers frequently work with third-party libraries or external repositories whose contents may be compromised.
From an operational perspective, this vulnerability allows for remote code execution under specific conditions where a user opens a malicious project configured to exploit the file watcher mechanism. The impact is severe as it grants the attacker control over the development environment, potentially leading to data exfiltration, installation of persistent backdoors, or pivoting into internal networks if the developer's machine has broader access rights. This aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically where user-controlled input influences code execution without proper sanitization. Furthermore, in terms of adversary behavior, this technique maps to ATT&CK T1059 Command and Scripting Interpreter, as it involves the use of system commands or scripts executed through a legitimate application feature rather than direct exploitation of an operating system vulnerability.
Mitigation strategies primarily involve upgrading JetBrains IntelliJ IDEA to version 2026.3 or later, where these security restrictions have been strengthened to prevent unauthorized command execution in untrusted contexts. Until such updates are applied, developers should exercise extreme caution when opening projects from unknown sources and consider disabling file watchers for Terraform files if they are not actively required for their workflow. Additionally, implementing strict code review processes and using isolated development environments can reduce the risk of executing malicious payloads derived from compromised infrastructure-as-code configurations. Security teams should also monitor for unusual process creation events originating from IDE-related binaries as an indicator of potential exploitation attempts in real-time monitoring systems.