The vulnerability in IntelliJ IDEA versions prior to 2026.3 allows an attacker to specify a non‑standard Terraform executable path in an untrusted project. When the IDE loads the project, it executes the attacker‑controlled Terraform binary, resulting in arbitrary local code execution with the privileges of the user running the IDE. The weakness is a pathname limitation flaw (CWE‑829).

JetBrains IntelliJ IDEA 2026.2.4 and earlier, including 2026.2.4, are affected. All releases before 2026.3 contain this flaw.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker can supply an untrusted project file that the user opens, so the attack vector is local. If the user opens a malicious project, the flaw can be leveraged to execute arbitrary code on the host.