In JetBrains IntelliJ IDEA before version 2026.3, the document import feature processed files from untrusted projects without adequate validation, allowing an attacker to execute arbitrary code. The flaw falls under CWE-829 and can compromise the confidentiality, integrity, and availability of the affected system, potentially leading to privilege escalation if executed with elevated rights.

The vulnerability affects JetBrains IntelliJ IDEA installations running any version prior to 2026.3. The issue is vendor‑specific and applies to all JetBrains IntelliJ IDEA products where untrusted project imports are enabled. Version information beyond the 2026.3 threshold is not provided, so administrators should verify that their installations are at least 2026.3 or later.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is not available, so the current exploitation probability is unclear. This vulnerability is not listed in the CISA KEV catalog, which may imply that known exploits have not yet been released or widely observed. Attackers would most likely need local access to the system or the ability to introduce a malicious project into the IntelliJ environment; therefore the likely attack vector is local or collaborator‑based rather than purely remote.