The vulnerability allows an attacker to inject and execute arbitrary code within IntelliJ IDEA through malicious UI Designer form files. The flaw corresponds to CWE‑94, a code injection weakness involving incorrect handling of generated code. If an attacker can place a crafted form file within a project that the IDE loads, they can run code with the permissions of the IDE, which may allow full compromise of confidentiality, integrity, or availability of the host machine.

JetBrains IntelliJ IDEA 2026.1 and earlier versions are affected. Users running any released version prior to 2026.2 that still use UI Designer form files are at risk. The issue does not affect later releases that have applied the fix.

The CVSS score of 8.1 indicates a high severity vulnerability, while the EPSS score of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in CISA KEV. Attackers would need the ability to introduce or ensure the loading of a malicious form file, so the likely attack vector is a local user with write access to the project or a shared project that the IDE can load; remote exploitation is possible only if a remote party can inject form files into a project that is subsequently opened by the victim.