The vulnerability in JetBrains IntelliJ IDEA allows an untrusted project opened before version 2026.3 to trigger changes to the GPG agent configuration. Because GPG agent settings control how code signing and repository authentication are performed, an attacker who can influence these settings could potentially cause code to be signed with inappropriate keys or bypass signing checks. The weakness is reflected in CWE-829.

JetBrains IntelliJ IDEA, versions earlier than 2026.3.

The CVSS score is 3.3, indicating a low severity impact. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting low exploitation likelihood. The nominal attack vector is local; a user opening a malicious project would need local access to the machine running the IDE, so the risk is primarily to legitimate users' environments rather than remote attackers.