JetBrains IntelliJ IDEA versions prior to 2026.3 allow Kotlin scripts within untrusted projects to trigger dependency downloads from arbitrary repositories. This vulnerability can enable an attacker to inject malicious or compromised libraries into the IDE’s build process or runtime environment, potentially leading to code execution or supply‑chain compromise. The weakness underlies CWE‑918, where uncontrolled input directs the system to external resources without proper validation.

Affected products include JetBrains IntelliJ IDEA for all releases older than 2026.3. No specific regression versions are listed, but any installation dated before the 2026.3 release is potentially vulnerable. Users on the latest release of 2026.3 or later are not affected.

The CVSS score of 5.4 indicates moderate severity. The EPSS score is not available, so exploitation likelihood cannot be quantified, and the vulnerability is not listed in CISA KEV. The most likely attack vector is a local or remote user who can add or modify Kotlin scripts in an untrusted project; the script then causes the IDE to download dependencies from attacker‑controlled repositories. Successful exploitation would provide the attacker with arbitrary code from those libraries, which could be executed in the IDE or in downstream build artifacts.