Description

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client request

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.1",
  "pubDate": "2026-11-06T11:17:10.720Z",
  "pubdate": "2026-11-06T11:17:10.720Z",
  "executiveSummary": "An XML External Entity (XXE) vulnerability has been identified within the HTTP Client feature of JetBrains IntelliJ IDEA.\nThe vulnerability allows an attacker to manipulate XML responses returned during HTTP requests to trigger unauthorized information disclosure.\nAffected versions include IntelliJ IDEA versions prior to 2026.3 and specifically 2026.2.4.\nThe risk implication involves the potential for local file inclusion, server-side request forgery (SSRF), or denial-of-service attacks depending on the parser configuration.\nAn attacker can exploit this by crafting a malicious XML response served over HTTP, which the IDE's client processes without sufficient security constraints on DTD (Document Type Definition) processing.\nExploitation requires the user to execute an HTTP request against a malicious or controlled endpoint that returns the crafted XML payload.\nThis represents a significant security risk for developers testing APIs or interacting with external services within the IDE environment.",
  "technicalDetails": "The vulnerability originates from the improper configuration of the XML parser used within the JetBrains IntelliJ IDEA HTTP Client component. Specifically, the parser fails to disable the processing of external entities or external DTDs when handling XML content returned in HTTP response bodies.\nXML External Entity (XXE) injection occurs when an XML input containing a reference to an external entity is processed by a weakly configured XML parser. By defining an entity using the SYSTEM identifier, an attacker can instruct the parser to fetch the content of local files or perform requests to internal network resources.\nThe attack flow proceeds as follows: First, the attacker triggers or waits for the user to initiate an HTTP request via the IntelliJ IDEA HTTP Client to a malicious server. Second, the malicious server responds with an HTTP response containing a malformed XML body. This body includes a Document Type Definition (DTD) that defines an external entity pointing to a sensitive file on the host operating system (e.g., file:///etc/passwd) or an internal network resource.\nWhen the HTTP Client processes the response, the underlying XML parser resolves the external entity. If the parser is not configured to disallow DTDs and external entities, it will attempt to retrieve the URI defined in the system identifier. This retrieval process embeds the content of the target file into the XML document structure, which may then be reflected in the IDE's response preview pane or logged output.\nThe vulnerable component is the XML response processing logic within the IDE's HTTP Client implementation. Because the IDE acts as the client, it possesses local context and potentially elevated file system access, turning a standard XML parsing error into a vector for local file disclosure or SSRF.\nThere are no explicit authentication requirements, as the vulnerability is inherent to the parsing logic of the tool itself when it processes network-sourced data. The attack is restricted to the network exposure of the specific endpoint the user chooses to test. Post-exploitation, the impact ranges from the exfiltration of sensitive configuration files, environment variables, or tokens stored on the developer's machine to the potential internal port scanning of the local development environment."
}