IntelliJ IDEA command injection via Tomcat run configurations on WSL

Opening untrusted projects in this developer tool can get your PC hacked.

Summary

Attackers can inject commands through Tomcat run configurations on WSL when a user opens an untrusted project. Versions before 2026.3 and 2026.2.1 are affected.

Affected when

Tomcat run configurations on WSL
Opening an untrusted project

What to do

Update to 2026.3 or 2026.2.1 or later.

Products and platforms

Windows
IntelliJ IDEA

CVE IDs

CVE-2026-123837 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-06 16:10 UTC

First seen 2026-11-09 18:10 UTC