CVE-2026-123840Medium· 4.7▾ SunlitIn JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs
▾ Sunlit zone — Low / medium · no exploitation signal
impact 25.9 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs
intellij_idea < 2026.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123837High· 7.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL
CVE-2026-123838High· 7.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file
CVE-2026-123841High· 7.8In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive
CVE-2026-123846Medium· 4.3In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation
CVE-2026-123848High· 7.4In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates
CVE-2026-123853High· 7.8In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process