A vulnerability in JetBrains IntelliJ IDEA versions prior to 2026.2 poses a high risk of unauthorized system impact through inclusion of control functionality.

This vulnerability involves the inclusion of control functionality from an untrusted source (CWE-829). The attack vector requires local access and user interaction to successfully trigger the flaw.

The vulnerability carries a CVSS score of 7.8, indicating a high severity level. Exploitation could lead to total compromise of confidentiality, integrity, and availability of the affected system, potentially allowing an attacker to execute arbitrary code or manipulate project files within the development environment.

Immediate Action: Update JetBrains IntelliJ IDEA to version 2026.2 or later as soon as the vendor makes the security release available.

Proactive Monitoring: Monitor developer workstations and build servers for unauthorized process execution or unexpected file system changes.

Compensating Controls: Ensure that development environments are isolated and that users only open project files from trusted, verified sources to prevent triggering malicious control functionality.

Public Exploit Available: No

Given the high CVSS score of 7.8, administrators should prioritize updating IntelliJ IDEA to the latest version. Organizations should emphasize secure coding practices and verify the integrity of imported project configuration files to mitigate the risk posed by this inclusion vulnerability.