HTML Injection Vulnerability in JetBrains IntelliJ IDEA Remote Development Editor
CVE-2026-123840

4.7MEDIUM

Key Information:

Vendor

Jetbrains
Status
Intellij Idea
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123840?

A vulnerability was identified in JetBrains IntelliJ IDEA that allows for HTML injection in the Remote Development editor tabs. This flaw enables attackers to potentially execute arbitrary HTML code, compromising user data and application integrity in affected versions prior to 2026.3. Vigilance is essential for users of JetBrains products to ensure safe coding practices and system security.

Affected Version(s)

IntelliJ IDEA 0 < 2026.3

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.