An attacker can achieve code execution by introducing a malicious script engine into an untrusted project within JetBrains IntelliJ IDEA. The flaw resides in the way IntelliJ discovers and loads script engines, allowing untrusted scripts to be executed without proper validation. This vulnerability is a classic example of CWE-829, enabling attackers to run arbitrary code within the IDE’s process and potentially compromise the host system.

JetBrains IntelliJ IDEA versions prior to 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2 are affected. These versions lack the necessary safeguards to prevent execution of script engines from untrusted projects.

The CVSS score of 7.8 indicates a high risk of exploitation. The EPSS score is not available, but the lack of a KEV listing suggests no known public exploits yet. The likely attack vector is local, where a malicious user can import a compromised project or place a harmful script engine within a project tree, after which IntelliJ will load and execute it. Due to the code execution nature, compromised confidentiality, integrity, and availability can result, potentially escalating to full system compromise if the IDE runs with elevated privileges.