This vulnerability permits injection of malicious HTML or JavaScript into the OpenAPI preview error view rendered by JetBrains IntelliJ IDEA, enabling an attacker to execute arbitrary script code under the user’s account, which could lead to theft of session cookies, credential hijacking, or additional attacks on other systems accessed through the compromised IDE session.

The affected product is JetBrains IntelliJ IDEA prior to version 2026.3. The CVE description explicitly states that the vulnerability exists only in those versions, which render untrusted OpenAPI specification content in a DOM-based error view.

The CVSS score of 8.2 classifies this as high severity. EPSS is not available; the vulnerability is not in the CISA KEV catalog. A malicious file must be opened by the user, so exploitation requires user interaction; it is local to the user’s machine but can impact confidentiality and integrity of all data accessed by the compromised session.