An attacker can execute arbitrary commands through the guest user account in JetBrains IntelliJ IDEA. This vulnerability arises from insufficient access control (CWE-862), allowing the guest user to run system commands. The resulting compromise can lead to full compromise of the system running the IDE and manipulation of build or deployment artifacts.

JetBrains IntelliJ IDEA prior to version 2026.1.1 is affected. Any installation of IntelliJ IDEA that includes the guest user account and does not apply the 2026.1.1 update is vulnerable.

The CVSS score of 8 indicates a high severity level. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting a moderate exploitation likelihood. The attack vector is inferred to require access to the guest user account, which may be local or remote depending on how the IDE is deployed. No additional conditions or prerequisites are specified in the description, but the presence of the guest account is required to exploit the flaw.