Description

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-11-06T11:17:08.013Z",
  "pubdate": "2026-11-06T11:17:08.013Z",
  "executiveSummary": "A critical security vulnerability exists in JetBrains IntelliJ IDEA that allows for remote code execution (RCE) within the context of untrusted projects.\nThe vulnerability stems from improper handling and validation of the Terraform tool path configuration within the IDE's settings.\nAn attacker capable of influencing the project configuration or providing a malicious project file to a user can force the IDE to execute arbitrary commands on the host machine.\nThe scope of this vulnerability affects IntelliJ IDEA versions prior to 2026.3 and 2026.2.4.\nSuccessful exploitation results in full code execution with the privileges of the IDE process, posing a significant risk for lateral movement, credential theft, and persistent system compromise.\nThis vulnerability is particularly dangerous when users open projects sourced from untrusted third parties, as the IDE does not sufficiently sanitize or verify the path integrity of the configured Terraform executable.\nNo specific authentication is required if the victim can be induced to open a malicious or specially crafted project configuration.",
  "technicalDetails": "The vulnerability resides within the IntelliJ IDEA Terraform plugin integration, specifically concerning how the IDE resolves and executes the Terraform binary defined in the project settings.\nRoot Cause: The IDE performs insufficient validation on the user-defined 'Terraform tool path' configuration. When the IDE interacts with the Terraform binary—typically during project indexing, resource validation, or automated plan execution—it fails to adequately sanitize the provided path. This allows an attacker to supply an arbitrary path pointing to a malicious binary or a script masquerading as the Terraform executable.\nExploitation Method: An attacker can distribute a project archive (such as a .zip or a Git repository) that contains a malformed '.idea' workspace configuration file. By modifying the Terraform tool path setting within these configuration files, an attacker can point the IDE to an executable file located within the project directory itself. When the victim opens the project, the IDE executes the attacker-controlled binary under the assumption that it is a legitimate Terraform tool.\nAttack Flow: 1. The attacker creates a malicious project containing a sub-directory with a crafted executable. 2. The attacker modifies the IDE's project-specific configuration files to reference the path of this malicious executable. 3. The victim opens the untrusted project in IntelliJ IDEA. 4. The IDE's Terraform plugin attempts to invoke the configured binary to verify infrastructure state or perform background tasks. 5. The operating system executes the malicious binary with the privileges of the IntelliJ IDEA process, leading to arbitrary code execution on the host.\nImpact: Because the IDE process often runs with the full permissions of the logged-in user, the execution of arbitrary code facilitates full system compromise. This includes the ability to install backdoors, exfiltrate environment variables, access stored credentials, and interact with private SSH keys or cloud configuration files present on the host system.\nVersion Scope: The vulnerability is identified in all versions of IntelliJ IDEA released prior to 2026.3, including version 2026.2.4.\nAuthentication/Privilege: No IDE-level authentication is required. Exploitation relies on the implicit trust model where the IDE assumes project-level settings are benign."
}