JetBrains IntelliJ IDEA versions prior to 2026.1.1 allow command injection through the filename completion feature. This flaw permits an attacker to execute arbitrary shell commands on the host where the IDE runs, compromising confidentiality, integrity, and availability across user sessions.

The vulnerability affects JetBrains IntelliJ IDEA installations running any version earlier than 2026.1.1. Users of the community or professional editions using the default file completion mechanism are within scope. No specific operating system restrictions were stated in the data.

The flaw carries a CVSS score of 7.8, indicating high severity. No EPSS value is available, so the likelihood of exploitation cannot be quantified. It is not listed in the CISA KEV catalog. Attackers could target the IDE from a local machine with sufficient privileges, possibly leveraging the feature in scripts or automated build processes. The vulnerability has no network exposure unless the IDE is exposed, so local compromise remains the primary threat vector.