Description

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-11-06T17:17:22.247Z",
  "pubdate": "2026-11-06T17:17:22.247Z",
  "executiveSummary": "A critical security vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2026.3, allowing for arbitrary code execution while the application is operating in Safe Mode.\nThe vulnerability originates from the improper handling of UI Designer form files, which may contain malicious instructions that bypass the restricted environment established by Safe Mode.\nSuccessful exploitation allows an unauthenticated, local attacker to execute arbitrary code within the context of the running application process.\nThis vulnerability presents a significant risk as it undermines the security sandbox designed to protect users when opening untrusted projects or files.\nThe attack vector involves the processing of a crafted UI Designer form file by the IDE, leading to the execution of unintended code during the rendering or preview phase.\nExploitation does not require prior authentication, provided the attacker can convince a user to open a malicious project or form file in an affected version of IntelliJ IDEA.",
  "technicalDetails": "The vulnerability resides within the UI Designer component of IntelliJ IDEA, specifically in how the IDE processes and renders .form files.\nSafe Mode is intended to mitigate risks by restricting the execution of potentially unsafe code, such as build scripts or plugins, when a project is considered untrusted.\nHowever, the UI Designer component fails to properly sanitize or validate the structural elements and associated bytecode references defined within form files during the initialization process in Safe Mode.\nWhen a user opens a maliciously crafted UI Designer form file, the IDE's internal parsing engine attempts to instantiate the components defined in the file.\nThe root cause is an improper trust boundary enforcement where the IDE treats the content of the UI form file as trusted input even while operating in the restricted Safe Mode sandbox.\nAttackers can leverage this by embedding references to existing application classes or utilizing serialized object structures that, when instantiated by the UI Designer, trigger the execution of arbitrary code.\nThe attack flow follows a sequential process: 1. An attacker prepares a malicious .form file containing references designed to trigger unsafe operations or invoke existing dangerous methods within the application classpath. 2. A user opens the project or the specific file within IntelliJ IDEA while Safe Mode is enabled. 3. The UI Designer component parses the form file to provide a visual preview. 4. During this rendering process, the IDE executes the malicious references contained within the form structure. 5. The arbitrary code is executed under the security context of the IntelliJ IDEA process, granting the attacker the same permissions as the IDE user.\nThis vulnerability bypasses the intended security isolation of Safe Mode, as the UI Designer component operates with sufficient privileges to execute code that should be blocked in such restricted modes.\nThe impact of successful exploitation includes full unauthorized access to the user's environment, potential data exfiltration, or the installation of persistent malicious backdoors, all occurring without the user's explicit consent or knowledge during the file preview stage."
}