Patch Ticker

IntelliJ IDEA runs code from untrusted projects

Opening untrusted projects in IntelliJ IDEA can let attackers hack your PC.

Summary

IntelliJ IDEA can run code from an untrusted project through script engine discovery. Versions before 2026.3, 2026.2.4, 2026.1.5.1 and 2025.3.6.2 are affected.

Affected when

  • Opening an untrusted project

What to do

Update to the fixed version for your line: 2026.3, 2026.2.4, 2026.1.5.1 or 2025.3.6.2.

Update to at least the version for your product:

  • IntelliJ IDEA 2026.3 2026.3 or later
  • IntelliJ IDEA 2026.2 2026.2.4 or later
  • IntelliJ IDEA 2026.1 2026.1.5.1 or later
  • IntelliJ IDEA 2025.3 2025.3.6.2 or later

Products and platforms

  • Windows
  • macOS
  • Linux
  • IntelliJ IDEA

CVE IDs

Times

First published

First seen