CVE-2026-123301High· 8.2▾ TwilightIn JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible
intellij_idea < 2026.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123309Medium· 6.1In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview
CVE-2026-123837High· 7.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL
CVE-2026-123838High· 7.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file
CVE-2026-123840Medium· 4.7In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs
CVE-2026-123841High· 7.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive
CVE-2026-123846Medium· 4.3In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation