Description
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 command execution via a hidden run control in the Markdown preview was possible
Published: 2026-11-06
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Command Execution
Action: Apply Patch
AI Analysis

Impact

The vulnerability allows command execution via a hidden run control embedded in the Markdown preview of JetBrains IntelliJ IDEA versions prior to 2026.3. An attacker with access to the IDE can trigger the hidden control and run arbitrary commands on the host system. This weakness corresponds to CWE-1021.

Affected Systems

Affected users run IntelliJ IDEA 2026.2.x, particularly 2026.2.4, and use the Markdown preview feature. The fix is available starting with version 2026.3. No other vendors or products are listed.

Risk and Exploitability

The CVSS score is 5.3, indicating a moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting the exploit probability is currently undetermined. Based on the description, it is inferred that the attack vector is local; an attacker must have access to the IDE installation. Nevertheless, because the vulnerability permits execution of commands via a hidden control, it poses a significant risk for anyone who runs untrusted Markdown files.

Generated by OpenCVE AI on November 6, 2026 at 12:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade IntelliJ IDEA to version 2026.3 or newer, which removes the hidden run control.
  • If an upgrade cannot be performed immediately, disable the Markdown preview feature in Settings → Editor → Markdown to prevent interaction with the hidden run control.
  • After applying the fix or disabling preview, delete the IntelliJ IDEA configuration directory to clear any remnants of the hidden control and then restart the IDE.

Generated by OpenCVE AI on November 6, 2026 at 12:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 12:30:00 +0000

Type Values Removed Values Added
Title Hidden Run Control in Markdown Preview Enables Command Execution

Fri, 06 Nov 2026 12:00:00 +0000

Type Values Removed Values Added
First Time appeared Jetbrains
Jetbrains intellij Idea
Vendors & Products Jetbrains
Jetbrains intellij Idea

Fri, 06 Nov 2026 10:30:00 +0000

Type Values Removed Values Added
Description In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown preview was possible
Weaknesses CWE-1021
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N'}

Subscriptions

Jetbrains Intellij Idea
cve-icon MITRE

Status: PUBLISHED

Assigner: JetBrains

Published:

Updated: 2026-11-06T10:28:02.008Z

Reserved: 2026-11-05T18:38:24.163Z

Link: CVE-2026-123311

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-06T11:17:10.333

Modified: 2026-11-06T11:17:10.333

Link: CVE-2026-123311

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T12:15:03Z

Weaknesses
  • CWE-1021

    Improper Restriction of Rendered UI Layers or Frames