In JetBrains IntelliJ IDEA before 2026.3, Tomcat run configurations executed inside Windows Subsystem for Linux contaminated the process with an unsafe command‑line handling flaw. This weakened input validation (CWE‑78) allows an attacker who supplies a malicious configuration to inject arbitrary shell commands that run with the IDE process privileges, potentially compromising the host system if the IDE is elevated.

JetBrains IntelliJ IDEA versions earlier than 2026.3 running on Windows with WSL support, when opening or creating projects that contain untrusted Tomcat run configurations. The flaw impacts all users who can access such projects.

The CVSS score of 7.8 indicates high severity, and the absence of an EPSS value or KEV listing suggests that extensive exploitation has not been observed yet. The most likely attack scenario involves an end user opening a maliciously crafted project or configuration. If the IDE runs with administrator rights, the attacker could gain full system control via the injected commands.