Description

In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-11-06T11:17:09.340Z",
  "pubdate": "2026-11-06T11:17:09.340Z",
  "executiveSummary": "A remote code execution vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2026.3, stemming from insecure configuration handling of the ShellCheck utility.\nThe vulnerability allows an attacker to achieve arbitrary code execution by manipulating the configured path for the ShellCheck external tool within an untrusted project environment.\nThis issue is classified as a command injection or configuration-based execution flaw, posing a significant risk to developers who open projects from untrusted or malicious sources.\nSuccessful exploitation allows an attacker to execute malicious payloads with the privileges of the IDE process, potentially leading to full system compromise, data exfiltration, or persistence on the developer's machine.\nThe attack is primarily facilitated by the IDE's reliance on user-supplied paths for static analysis tools without adequate validation or sandbox isolation.\nNo specific network exposure is required if the attacker can influence the project configuration, which is common in distributed development workflows.",
  "technicalDetails": "The vulnerability originates in the integration between IntelliJ IDEA and the ShellCheck static analysis tool. IntelliJ IDEA allows users to specify an absolute or relative path to an external ShellCheck executable to perform linting and analysis on shell scripts within the IDE.\nThe root cause is an insecure handling of the configured executable path when the IDE invokes the binary during project analysis. When a project is loaded, the IDE reads the project-level settings, which may include a maliciously crafted path for the ShellCheck utility defined in the project's configuration files (e.g., .idea directory).\nAn attacker can exploit this by providing a malicious project repository to a target victim. When the victim opens the project in a vulnerable version of IntelliJ IDEA, the IDE attempts to resolve and execute the ShellCheck binary based on the tainted configuration. Instead of pointing to a legitimate utility, the configuration is set to point to a malicious script or binary embedded within the project repository.\nThe attack flow follows these steps: 1. The attacker modifies the project configuration to set the 'ShellCheck path' to a malicious executable residing within the project workspace. 2. The victim opens the untrusted project in IntelliJ IDEA. 3. The IDE, upon initializing the project and its external tools, triggers the ShellCheck analysis process. 4. Due to the lack of path validation or origin checks, the IDE executes the malicious file instead of the intended ShellCheck utility. 5. The malicious payload executes with the same OS-level privileges as the IntelliJ IDEA application process.\nThis vulnerability bypasses standard execution flow protections because the IDE implicitly trusts the provided tool path for configuration-based automation. Because the IDE runs with the user's full permissions, the exploit can perform any action the user is authorized to execute, including modifying system files, accessing environment variables, or establishing a reverse shell to an attacker-controlled listener.\nAffected versions include all releases of IntelliJ IDEA prior to 2026.3. The vulnerability does not require authentication to the platform, as the attack is triggered locally upon opening a project file. The requirement is merely the ability to induce a developer to open a compromised project workspace, making it a critical threat for developers interacting with community-contributed code."
}