Description

In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-11-06T11:17:09.067Z",
  "pubdate": "2026-11-06T11:17:09.067Z",
  "executiveSummary": "A DOM-based Cross-Site Scripting (XSS) vulnerability exists within the OpenAPI preview error view functionality of JetBrains IntelliJ IDEA. This security flaw allows a remote or local attacker to execute arbitrary JavaScript within the context of the application's internal web view.\nThe vulnerability occurs due to improper handling of untrusted data processed by the OpenAPI preview component, leading to the execution of malicious scripts when the error view renders manipulated content.\nThe impact includes potential unauthorized access to sensitive information, session hijacking, or the execution of unauthorized actions within the IDE environment. Any version of IntelliJ IDEA prior to 2026.3 is considered affected. Exploitation typically requires the victim to interact with a malformed OpenAPI specification or an error-inducing configuration that triggers the vulnerable rendering path.\nSuccessful exploitation compromises the integrity of the user's IDE session. Organizations should prioritize updating to version 2026.3 or later to mitigate this risk.",
  "technicalDetails": "The vulnerability is categorized as a DOM-based Cross-Site Scripting (XSS) flaw, specifically residing within the rendering engine responsible for displaying OpenAPI preview error messages. DOM-based XSS occurs when an application contains client-side JavaScript that processes data from an untrusted source in an unsafe way, usually by writing the data to the Document Object Model (DOM).\nIn this specific instance, the OpenAPI preview error view improperly sanitizes input data before injecting it into the DOM. When the IDE attempts to render an error message derived from an OpenAPI specification file—such as a malformed schema or an invalid path definition—the application fails to encode or neutralize special characters. An attacker can craft an OpenAPI file containing malicious payloads, such as script tags or event handlers, that the rendering component treats as executable code rather than plain text.\nThe attack flow begins when a user opens a malicious or crafted OpenAPI specification file within IntelliJ IDEA. When the internal web-based preview engine encounters an error while parsing the file, it generates an error report that incorporates the unsanitized input. The client-side JavaScript responsible for rendering this view then executes the payload upon injection into the DOM tree. Because the preview engine operates with the permissions of the IDE, the injected script may gain access to the context of the internal webview.\nThis execution environment allows for the manipulation of the document, including the ability to access data stored in the local storage, interact with browser-based APIs within the webview, or potentially bridge out to perform actions within the IDE context if sandbox restrictions are misconfigured. No specific authentication is required to trigger this vulnerability, as the execution is a direct result of the IDE's processing logic. The vulnerability affects all versions of IntelliJ IDEA prior to 2026.3, necessitating an update to the patched version which addresses the underlying input sanitization failure within the OpenAPI preview component."
}