The vulnerability allows an attacker to force the IDE to execute arbitrary shell commands through a malicious ShellCheck path configured in the project settings. This results in code execution on the host system with the privileges of the user running IntelliJ IDEA. The weakness is identified by CWE-829.

JetBrains IntelliJ IDEA versions earlier than 2026.3 are affected. Any untrusted project loaded into these versions may be used to trigger the flaw. The issue is present across all platforms supported by IntelliJ IDEA that use the ShellCheck integration.

The vulnerability scores a CVSS of 7.8, indicating a high impact. No EPSS value is published, and the issue is not listed in the CISA KEV catalog, so the attack probability is unknown. The attack vector is inferred to be through the project environment, meaning that local users or compromised code within an untrusted project can trigger execution. The lack of a known public exploit suggests that the flaw may currently be under undisclosed exploitation, but the high CVSS still warrants immediate attention.