A vulnerability was discovered in the UI Designer form parser of JetBrains IntelliJ IDEA, allowing an attacker to specify XML external entity references (xEEs). The flaw permits the loading of arbitrary local resources or external data during the parsing of form files. Since the vulnerability is tied to the form parser, the primary impact is the potential for unintended data disclosure rather than remote code execution. The associated CWE indicates a weakness in XML processing logic that can lead to information leakage.

JetBrains IntelliJ IDEA versions prior to 2026.1 are impacted. No additional sub‑versions or build identifiers are supplied, so all installations using a pre‑2026.1 release are considered vulnerable.

The CVSS score of 3.3 classifies this issue as low severity. The EPSS score is not available, providing no indication of current exploitation trends. JetBrains has not listed this vulnerability in the CISA KEV catalog. Likely attack vectors are local: a malicious user could create or manipulate a UI Designer form file containing an XML external entity, or a compromised plugin could supply such a file to the parser. The lack of a public exploit suggests that the vulnerability is not actively leveraged by threat actors, but the potential for accidental exposure exists if untrusted files are processed.