JetBrains IntelliJ IDEA versions before 2026.3 contain a stored XSS flaw in the built‑in web server that is triggered when a Markdown file containing malicious script is opened and the preview function is used. The script is rendered inside the IDE’s web interface and can run in the context of the local user’s environment, potentially allowing local attackers to execute arbitrary code or leak data that the IDE can access. The vulnerability is a classic input‑validation flaw that fails to neutralize executable content before rendering.

The flaw affects JetBrains IntelliJ IDEA 2026.2.4 and earlier releases prior to 2026.3. Any installation that uses the built‑in web server to preview Markdown documents is susceptible. The issue is specific to the IntelliJ IDEA product family and does not impact other JetBrains products that do not expose this preview capability.

The CVSS score of 6.1 places the vulnerability in the medium severity range. While no EPSS score is available, the lack of a CISA KEV listing suggests that widespread exploitation has not been observed yet. Nevertheless, the flaw can be exploited by a local user or a malicious plugin that causes the IDE to load a crafted Markdown file. The impact could include unauthorized script execution, data exfiltration, or escalation of local privileges if the script can interact with the IDE’s runtime environment. The risk level remains moderate, but organisations with high‑security environments should treat it as a potential threat until a remediation is applied.