A flaw in JetBrains IntelliJ IDEA allows attacker‑controlled input of control characters into the terminal command completion logic, resulting in arbitrary command execution. This weakness can be exploited to run unintended commands within the IDE’s runtime environment, potentially compromising the host system. The primary impact is the unauthorized execution of commands, leading to privacy and integrity violations for users of the affected IDE.

The vulnerability affects JetBrains IntelliJ IDEA installations prior to version 2026.3. Users running older releases of this IDE are susceptible to exploitation.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, suggesting no widespread exploitation yet. The likely attack vector is local, requiring an attacker with access to the IDE or the ability to influence terminal input. Despite the moderate score, the command execution capability warrants timely mitigation.