JetBrains IntelliJ IDEA versions prior to 2026.2.3 allow an attacker to execute arbitrary code through the use of Structural Search script constraints. An attacker who has the ability to load a project marked as untrusted can exploit this flaw to run code with the privileges of the running IntelliJ process, leading to potential compromise of confidentiality, integrity, and availability of the host system. The weakness corresponds to CWE-829.

All installations of JetBrains IntelliJ IDEA that have not been patched are affected. The CVE data does not provide specific version ranges, so any unpatched version may be vulnerable. The vulnerability is specific to the product’s handling of untrusted project files and does not affect other JetBrains or third‑party software.

The flaw carries a CVSS score of 7.8, indicating high severity. EPSS information is unavailable, so the likelihood of widespread exploitation is uncertain, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector requires an attacker to introduce a malicious project into the IDE environment, which could be accomplished via shared code repositories or compromised build systems. Once the project is loaded, the structural search scripts gain the full authority of the user running IntelliJ, potentially allowing arbitrary code execution.