The flaw originates from the Terraform File Watchers feature in JetBrains IntelliJ IDEA. Before version 2026.3, any untrusted project containing Terraform files could trigger code execution when the File Watcher processes those files, exploiting an excess of permission (CWE‑829). This permits an attacker to execute arbitrary code within the IDE’s process, potentially compromising the developer environment.

JetBrains IntelliJ IDEA is affected. All releases prior to 2026.3 carry the vulnerability; no more granular version information is provided by the CNA.

The CVSS score of 7 indicates a high severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalogue, suggesting no documented exploitation yet. The likely attack vector is an attacker introducing or manipulating a Terraform file in an untrusted project that the IDE monitors, which the File Watcher then processes and executes.