Description
In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects
Published: 2026-08-17
Score: 3.6 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

JetBrains IntelliJ IDEA versions prior to 2026.2.1 allow command execution when a user opens a crafted Markdown preview file in a trusted project. The flaw is rooted in the processing of Markdown content, which can include directives that trigger system commands, making it a classic command injection problem (CWE-77). The impact is limited to the local user who opens the preview; remote exploitation is not described and the CVSS score of 3.6 reflects a low severity.

Affected Systems

All installations of JetBrains IntelliJ IDEA running any version older than 2026.2.1 are vulnerable when projects are marked as trusted. Users of earlier releases should update to 2026.2.1 or later, which includes the fix that removes unsafe command execution during Markdown rendering.

Risk and Exploitability

The exploit requires a trusted project and the user to launch the Markdown preview, making it a local, interactive attack vector. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating it has not been widely exploited. The low CVSS score further suggests a modest risk, but any user who can deliver or open a malicious Markdown file could run arbitrary commands on their machine. Updating to the patched release remains the definitive mitigation.

Generated by OpenCVE AI on August 17, 2026 at 18:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the official fix by upgrading to version 2026.2.1 or newer, which eliminates the command injection flaw identified as CWE‑77.
  • As a temporary measure, disable Markdown preview in the IDE settings to prevent processing of malicious Markdown content, thereby mitigating the CWE‑77 injection risk.
  • Keep projects marked as untrusted while the disabled preview remains in place, ensuring the vulnerability cannot be triggered even if a malicious file is opened.

Generated by OpenCVE AI on August 17, 2026 at 18:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:jetbrains:intellij_idea:*:*:*:*:*:*:*:*

Mon, 17 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 17 Aug 2026 18:30:00 +0000

Type Values Removed Values Added
Title Local Command Execution via Crafted Markdown Preview in IntelliJ IDEA

Mon, 17 Aug 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Jetbrains
Jetbrains intellij Idea
Vendors & Products Jetbrains
Jetbrains intellij Idea

Mon, 17 Aug 2026 16:00:00 +0000

Type Values Removed Values Added
Description In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects
Weaknesses CWE-77
References
Metrics cvssV3_1

{'score': 3.6, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}

Subscriptions

Jetbrains Intellij Idea
cve-icon MITRE

Status: PUBLISHED

Assigner: JetBrains

Published:

Updated: 2026-08-17T18:34:44.269Z

Reserved: 2026-08-17T15:34:09.054Z

Link: CVE-2026-75052

cve-icon Vulnrichment

Updated: 2026-08-17T18:34:18.722Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-17T16:17:52.320

Modified: 2026-09-01T19:49:41.540

Link: CVE-2026-75052

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-17T18:15:05Z

Weaknesses
  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')