In JetBrains IntelliJ IDEA versions prior to 2026.3, users could inject arbitrary HTML into the Remote Development editor tabs. This flaw permits attackers to craft malicious content that is rendered within the editor UI, potentially leading to cross‑site scripting attacks or execution of unintended scripts. The violation falls under CWE‑80 and could allow attackers to alter the appearance of the editor, exfiltrate data, or trigger additional client‑side code execution.

The affected product is JetBrains IntelliJ IDEA before 2026.3. Any instance exposing Remote Development features is vulnerable. This flaw is tied to the JetBrains IntelliJ IDEA product line; specific version information is limited to the pre‑2026.3 releases.

The CVSS score of 4.7 indicates moderate overall risk. EPSS is not available, suggesting no reliable estimate of exploitation likelihood, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector requires access to the Remote Development session, meaning the threat is primarily internal or requires an attacker who can inject content into the development environment. Without external exposure, the exploitation potential is limited but could still impact users interacting with compromised editor tabs.