CVE-2026-64811: 
JetBrains IntelliJ IDEA vulnerability analysis and mitigation

CVE-2026-64811 is an arbitrary code execution vulnerability in JetBrains IntelliJ IDEA affecting all versions before 2026.2. The flaw allows code execution to occur prior to a user granting project trust, specifically through malicious development container configuration files. It was published on July 23, 2026, and assigned a CVSS v3.1 base score of 7.8 (High) by JetBrains (JetBrains Advisory, NVD).

The vulnerability is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), meaning IntelliJ IDEA processes development container configuration files from an untrusted source before the user has explicitly granted trust to the project. This bypasses the IDE's project trust safety mechanism, which is designed to prevent automatic execution of potentially malicious project-level configurations. An attacker would need to supply a crafted .devcontainer or equivalent configuration file — for example, by distributing a malicious repository — and the victim must open the project in IntelliJ IDEA. User interaction is required, but no privileges are needed on the attacker's part (JetBrains Advisory, NVD).

Successful exploitation grants an attacker arbitrary code execution with the privileges of the IntelliJ IDEA process on the victim's machine, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive source code, credentials, or environment variables accessible to the IDE process, modify project files or local system data, and potentially use the compromised developer workstation as a pivot point for further lateral movement within a corporate network. The scope is limited to the local system, but developer machines typically have broad access to internal resources, making this a high-value target (NVD, JetBrains Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. CISA's SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for user interaction (opening a malicious project). The EPSS score is approximately 0.00126, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (NVD, Feedly).

1. Craft malicious repository: Create a Git repository containing a development container configuration file (e.g., .devcontainer/devcontainer.json or docker-compose.yml) with malicious commands or scripts embedded in lifecycle hooks (e.g., postCreateCommand, initializeCommand).
2. Distribute the repository: Host the repository on a public or internal platform (e.g., GitHub, GitLab, internal Gitea) and socially engineer a target developer into cloning or opening it in IntelliJ IDEA.
3. Trigger automatic processing: When the victim opens the project in a vulnerable version of IntelliJ IDEA (before 2026.2), the IDE processes the development container configuration before the project trust dialog is presented or confirmed.
4. Achieve code execution: The malicious lifecycle hook commands execute with the privileges of the IntelliJ IDEA process on the developer's workstation, enabling data exfiltration, backdoor installation, or further lateral movement (NVD, JetBrains Advisory).

• File System: Unexpected .devcontainer/devcontainer.json or related configuration files in recently cloned repositories containing unusual postCreateCommand, initializeCommand, or onCreateCommand entries; new or modified files in user home directories or IDE plugin directories shortly after opening a new project.
• Process: Unusual child processes spawned by the IntelliJ IDEA JVM process (e.g., bash, sh, cmd.exe, powershell, curl, wget, python) before the project trust dialog is displayed.
• Network: Unexpected outbound network connections from the IntelliJ IDEA process to unknown external IP addresses or domains shortly after a project is opened.
• Logs: IDE log files (idea.log) showing container configuration parsing activity prior to trust grant events; system audit logs recording process creation events with IntelliJ as the parent process executing shell commands.

JetBrains has released a fix in IntelliJ IDEA version 2026.2, which resolves the premature processing of development container configurations before project trust is granted. Users should update to version 2026.2 or later immediately. As a temporary workaround, developers should exercise caution when opening projects from untrusted or unfamiliar sources, and manually inspect any development container configuration files before allowing IntelliJ IDEA to process them (JetBrains Advisory, NVD).

A Mastodon post by security researcher @hugovalters noted the vulnerability shortly after disclosure, and CyberPress published a brief article referencing the flaw in the context of IntelliJ IDEA path traversal and code execution issues. Community reaction has been relatively muted given the absence of a public PoC and active exploitation. No significant vendor statements beyond the JetBrains security advisory page have been identified (CyberPress, Mastodon).