JetBrains IntelliJ IDEA before version 2026.3 is vulnerable to a server side request forgery when processing annotations.xml files during the indexing phase. The flaw permits an attacker to force the IDE to resolve and fetch URLs embedded in the XML, potentially causing traffic to internal or external networks. The weakness is classified as CWE‑827, reflecting improper validation of user-controlled input in a server context. While the attack would not execute arbitrary code, it can lead to unintended network requests and possibly leakage of sensitive data or denial of service through link saturation.

JetBrains IntelliJ IDEA versions prior to 2026.3, including the 2026.2.4 release, are affected. The issue arises when the IDE processes annotations.xml files during project indexing. Users must upgrade to 2026.3 or later to eliminate the vulnerability.

The CVSS base score of 3.3 classifies this flaw as low severity. Because the EPSS score is not available, there is no published estimate of exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog, indicating no known exploits. The likely attack vector involves an attacker controlling or injecting malicious URLs into annotations.xml files, which is then processed during local IDE indexing or, in the case of CI pipelines, during automated indexing. This suggests the fragility of the attack is limited to environments where the IDE has access to network resources and where project files can be tampered with.