Description

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown preview

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-11-06T11:17:10.053Z",
  "pubdate": "2026-11-06T11:17:10.053Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability exists within the built-in web server component of JetBrains IntelliJ IDEA. This flaw allows an attacker to inject malicious scripts into the Markdown preview functionality. When rendered, these scripts execute within the context of the built-in web server's origin. The vulnerability impacts versions prior to 2026.3 and 2026.2.4. Successful exploitation could allow an attacker to bypass security restrictions, access local resources, or perform unauthorized actions on behalf of the user within the local development environment. The exploitation requirement involves a user viewing or interacting with a maliciously crafted Markdown file within the affected IDE environment. Given the nature of the built-in web server, this poses a significant risk to developers who may be working with untrusted or externally sourced documentation files.",
  "technicalDetails": "The vulnerability originates from improper sanitization of Markdown content before it is processed and rendered by the IDE's built-in web server. When the Markdown preview feature is triggered, the IDE parses the Markdown document and translates it into HTML for display. If the parsing logic fails to adequately neutralize executable code, an attacker can embed malicious JavaScript payloads—such as <script> tags or event handler attributes—directly into the Markdown source file.\nThe attack flow begins with the delivery of a malicious Markdown file to the victim. Once the victim opens this file within an affected version of IntelliJ IDEA (versions prior to 2026.3 or 2026.2.4), the IDE invokes the built-in web server to render the preview. Because the web server treats the generated HTML as trusted content, the injected script is executed by the rendering engine. The script executes within the security context of the local loopback address (e.g., http://127.0.0.1) where the built-in server resides.\nThis execution context is particularly dangerous because the built-in web server often shares the same origin or session tokens as other IDE services. Consequently, the XSS payload can potentially perform requests to other internal endpoints of the IDE, exfiltrate sensitive local data, or interact with IDE-specific APIs if they are exposed to the web server's origin. The vulnerability does not require authentication to the web server itself, as the exploitation is triggered by the IDE's internal rendering workflow initiated by the user. The primary root cause is a failure in the input validation or output encoding layer that processes Markdown blocks, allowing arbitrary script injection that is then served to the browser-based preview component."
}