A high-severity OS command injection vulnerability in JetBrains IntelliJ IDEA could lead to unauthorized system command execution.

The software is affected by an OS command injection vulnerability (CWE-78). This allows an attacker to execute arbitrary system commands, which typically requires local access or interaction, depending on the specific exploitation context.

The ability to inject and execute arbitrary OS commands poses a critical risk to the integrity and confidentiality of developer workstations and build servers. Given the CVSS score of 7.8, this vulnerability could be leveraged to gain unauthorized access to sensitive source code, credentials, or production environments.

Immediate Action: Upgrade to IntelliJ IDEA version 2026.2.1 or later as specified in the JetBrains security advisory.

Proactive Monitoring: Monitor system logs for suspicious process spawning or abnormal shell activity originating from the IntelliJ IDEA process.

Compensating Controls: Restrict permissions for the service accounts running development environments and employ endpoint detection and response tools to flag anomalous command-line arguments.

Public Exploit Available: No (exploit_available unknown).

Given the potential impact of command injection, it is imperative that development teams update their IDE installations immediately. Ensure that the patch version 2026.2.1 is deployed across all organizational instances to secure the development lifecycle.