CVE-2026-75058 in IntelliJ IDEA
Summary
by MITRE • 08/17/2026
In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified as CVE-2024-XXXXX, affecting versions of JetBrains IntelliJ IDEA prior to version 2026.2.1, represents a critical security flaw within the application's configuration management subsystem. Specifically, this issue resides in the Eclipse settings importers, which are designed to facilitate the migration and synchronization of development environments by importing project configurations from older or alternative Integrated Development Environments (IDEs). The core technical deficiency lies in the insufficient validation and sanitization of input data during the parsing process of these imported configuration files. When a user initiates an import operation using a maliciously crafted Eclipse settings file, the application fails to adequately restrict the types of resources that can be referenced or executed as part of the import routine. This lack of rigorous boundary checking allows for arbitrary code execution on the host system where the IDE is running. The flaw essentially treats untrusted input from external configuration files with excessive trust, assuming that all paths and commands defined within these settings are safe to execute without verification against a whitelist of allowed operations or directories.
From an operational perspective, this vulnerability poses a severe risk to developers who rely on IntelliJ IDEA for their daily workflows. An attacker can exploit this flaw by distributing a specially crafted Eclipse configuration file through social engineering tactics such as phishing emails, compromised repositories, or malicious plugins disguised as legitimate project settings. Once the victim opens and imports this file within IntelliJ IDEA, the application will execute arbitrary commands with the privileges of the currently logged-in user. This capability enables a wide range of post-exploitation activities including but not limited to data exfiltration, installation of persistent backdoors, lateral movement across internal networks if shared drives are accessed, or complete system compromise depending on the privilege level of the IDE process. The impact is particularly acute in enterprise environments where developers frequently share project configurations and collaborate using standardized settings files that may be sourced from untrusted third parties or external contributors.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code Command Injection, as it involves the unauthorized execution of commands due to improper neutralization of special elements used in an OS command. Furthermore, within the context of the MITRE ATT&CK framework, this exploit maps directly to T1059 Command and Scripting Interpreter, specifically under techniques that allow for remote code execution via trusted applications. The attack vector is classified as Local with High Privileges if the user has administrative rights, or Medium Privileges otherwise, but it can also be considered Remote Code Execution in scenarios where the malicious file is delivered remotely and automatically processed upon opening without explicit user interaction beyond clicking a link to open the IDE project.
To mitigate this risk, organizations must immediately upgrade all instances of IntelliJ IDEA to version 2026.2.1 or later, which contains patches that enforce stricter validation rules on imported configuration data. Until the update is applied, security teams should implement strict application whitelisting policies to prevent unauthorized executables from running in directories associated with IDE configurations. Additionally, users should be educated to exercise extreme caution when importing settings files from unknown sources and to verify the integrity of such files using checksums or digital signatures before processing them within the IDE. Network segmentation strategies can also help limit the blast radius if a compromise occurs by restricting outbound connections from development workstations to only necessary endpoints. Regular auditing of imported configurations and disabling automatic import features where possible further reduces the attack surface associated with this vulnerability.