A vulnerability in JetBrains IntelliJ IDEA allows an attacker to achieve host-level code execution by bypassing project-trust checks during Dev Container builds.

The software fails to implement necessary project-trust confirmation mechanisms when building Dev Containers, which corresponds to CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). This flaw allows an unauthenticated attacker, who can provide a malicious project file, to execute arbitrary code on the host machine upon container initialization.

The ability for a remote or local attacker to achieve host-level code execution represents a critical security failure, as it grants full control over the developer workstation. Given the CVSS score of 7.8, this vulnerability poses a high risk of lateral movement within a corporate network, potential theft of intellectual property, and compromise of sensitive development credentials.

Immediate Action: Upgrade JetBrains IntelliJ IDEA to version 2026.2.2 or later to include the required security patches.

Proactive Monitoring: Review developer workstation access logs and monitor for unexpected process spawning originating from the IntelliJ process space or Dev Container orchestration modules.

Compensating Controls: Restrict the opening of untrusted projects or Dev Containers from unknown sources until the software has been updated to a secure version.

Public Exploit Available: No (exploit_available unknown).

This vulnerability presents a significant risk to development environments by allowing unauthorized code execution at the host level. Security teams should prioritize the deployment of the 2026.2.2 update across all workstations running IntelliJ IDEA to ensure that trust verification protocols are properly enforced.