JetBrains IntelliJ IDEA versions older than 2026.3, including 2026.2.4, contain a data‑deserialization weakness that allows an XXE (XML External Entity) attack when an XML response is processed by the IDE’s HTTP client. The flaw permits malicious XML to trigger external entity resolution, which can lead to the leakage of local files or execution of arbitrary code on the host system. This weakness is classified as CWE‑611: Improper Restriction of XML External Entity Reference.

All installations of JetBrains IntelliJ IDEA running before version 2026.3, notably version 2026.2.4, are vulnerable.

The CVSS score of 3.1 indicates a low to moderate impact. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited active exploitation. An attacker would need to trigger an XML response from an external or local HTTP request processed by the IDE; the attack appears to be possible over the network, but requires that the IDE’s HTTP client be invoked with crafted XML content. Defenses include disabling external entity processing or updating to a patched version.