A critical path traversal vulnerability in JetBrains IntelliJ IDEA allows remote attackers to execute arbitrary code on the host system.

This vulnerability involves a path traversal flaw in the project workspace ID handling mechanism. An attacker can leverage this to escape expected directories and execute arbitrary code, necessitating user interaction.

The ability to execute arbitrary code on developer workstations presents a severe security risk, potentially leading to full system compromise, exfiltration of proprietary source code, and lateral movement into the corporate network. With a CVSS score of 9.6, this vulnerability is classified as critical, reflecting the high potential for total system takeover.

Immediate Action: Upgrade to version 2026.1.4 or higher immediately to apply the patch for the path traversal flaw.

Proactive Monitoring: Review system access logs for anomalous file path requests or unexpected process execution patterns originating from the IDE.

Compensating Controls: Ensure that developer machines operate under the principle of least privilege, minimizing the impact of potential code execution.

Public Exploit Available: false

Given the critical severity of this remote code execution vulnerability, immediate patching is required. Organizations should prioritize the deployment of the updated version across all developer environments to prevent potential compromise of source code repositories and sensitive development assets.