CVE-2026-49366: IntelliJ IDEA Command Injection via Filename Completion

Technical summary

CVE-2026-49366 is a local command injection vulnerability (CWE-78) in IntelliJ IDEA's filename completion subsystem. The flaw arises from insufficient input sanitization when processing file completion suggestions, permitting shell metacharacter injection. An attacker can craft a malicious filename or directory structure that, when the victim invokes code completion, executes arbitrary shell commands in the context of the IDE process. The attack surface is limited to local users with filesystem write access to locations the developer may browse during editing sessions.

Business impact

For organizations employing IntelliJ IDEA across development teams, this vulnerability poses a containment risk: a compromised developer machine can become an entry point for lateral movement, intellectual property theft, or supply chain attacks if the developer has access to version control systems or internal repositories. The impact is especially acute in environments where developers run the IDE with elevated privileges or where IDE processes have access to credentials, API keys, or sensitive build artifacts. Prompt patching reduces the window of exposure.

Affected systems

JetBrains IntelliJ IDEA releases prior to 2026.1.1 are affected. This includes all 2026.1.0 and earlier versions within the 2026 release cycle, as well as all prior major versions (2025, 2024, etc.) unless they have received backported security updates. Organizations should verify their installed version against the JetBrains advisory to confirm exposure.

Exploitability

Exploitability is moderate. The attack requires local code execution capability or social engineering a developer to open a specially crafted project directory. It is not remotely exploitable over the network in its base form. However, the requirement for user interaction (triggering filename completion) is relatively low friction—developers routinely use autocomplete during normal editing workflows. No public exploit code has been added to CISA's Known Exploited Vulnerabilities catalog, though the attack technique is straightforward once a malicious project structure is in place.

Remediation

Upgrade IntelliJ IDEA to version 2026.1.1 or later. JetBrains has patched the filename completion input validation to reject or properly escape shell metacharacters. Organizations should prioritize this patch for development machines, especially those handling sensitive projects or with access to production infrastructure.

Patch guidance

Download and install IntelliJ IDEA 2026.1.1 or a later release from the official JetBrains website. The IDE's built-in update mechanism can be used: Help > Check for Updates (or equivalent in your IDE layout). Verify the patch version in Help > About before resuming work. For air-gapped environments, download the installer directly from JetBrains and deploy via your internal software distribution channels. Users on earlier major version lines should consult the JetBrains advisory to confirm whether backports are available.

Detection guidance

Monitor for suspicious child process spawning from IntelliJ IDEA processes (java.exe or idea.exe on Windows; java on Unix-like systems). Look for command-line arguments containing shell metacharacters (pipe, semicolon, backtick, $()) originating from the IDE process. Endpoint detection and response (EDR) tools should alert on any unexpected command execution initiated by the IDE. On development machines, audit filesystem write access to project directories by non-developers. Review IDE project files (.idea directory) for embedded shell commands in configuration or file references.

Why prioritize this

Despite not appearing on CISA's KEV list, this vulnerability merits urgent attention due to its HIGH CVSS score (7.8), the prevalence of IntelliJ IDEA in enterprise development environments, and the trivial user interaction barrier. Command injection on a developer machine creates outsized risk because developers often have elevated access and interact with sensitive systems. The local-only requirement prevents immediate widespread remote exploitation but does not diminish the need for rapid patching within your development team.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: (1) Local attack vector (AV:L)—limiting but not negating risk; (2) Low attack complexity (AC:L)—straightforward exploitation technique; (3) No privilege escalation required (PR:N); (4) User interaction needed (UI:R)—developers use autocomplete routinely, making this a low barrier; (5) High impact across confidentiality, integrity, and availability (C:H/I:H/A:H)—full system compromise. The score appropriately weights the severity of command execution against the local-only scope.

Frequently asked questions