Dependency Download Vulnerability in JetBrains IntelliJ IDEA
CVE-2026-123310

5.4MEDIUM

Key Information:

Vendor

Jetbrains
Status
Intellij Idea
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123310?

A vulnerability in JetBrains IntelliJ IDEA allows kotlin scripts to initiate dependency downloads from arbitrary and potentially unsafe repositories within untrusted projects. This vulnerability arises when users run such scripts, exposing them to the risk of integrating malicious code into their development environment. The affected versions include IntelliJ IDEA 2026.2 and earlier, necessitating users to review their security practices and utilize updated software to mitigate these risks.

Affected Version(s)

IntelliJ IDEA 0 < 2026.3

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.