Description

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-11-06T17:17:23.850Z",
  "pubdate": "2026-11-06T17:17:23.850Z",
  "executiveSummary": "A critical security vulnerability identified in JetBrains IntelliJ IDEA allows for arbitrary code execution within the context of untrusted projects.\nThe vulnerability resides in the interaction between the IDE and the Terraform File Watchers feature.\nBy manipulating specific project configurations, a malicious actor can achieve unauthorized code execution on the host machine running the affected IDE version.\nThis flaw impacts all versions of IntelliJ IDEA prior to 2026.3.\nThe risk implication is severe, as successful exploitation bypasses standard project sandboxing or warnings typically associated with executing untrusted code.\nThe attack requires the victim to open a maliciously crafted project containing specific Terraform configurations, enabling the File Watcher feature to execute arbitrary system-level commands.\nThere is no requirement for remote network access, as the threat is localized to the processing of project-level file structures.",
  "technicalDetails": "The vulnerability is rooted in the insecure handling of Terraform File Watchers within the IntelliJ IDEA ecosystem. File Watchers are designed to trigger specific commands or tasks automatically when changes to project files are detected. In the affected versions of IntelliJ IDEA, the IDE does not sufficiently validate or sanitize the configuration parameters associated with these watchers when loading a project from an external or untrusted source.\nWhen a user opens a project containing a specially crafted configuration file, the IDE parses the Terraform File Watcher settings. If an attacker defines a malicious command within the watcher configuration, the IDE’s background processes may automatically execute this command with the privileges of the user running the IDE. This occurs because the IDE inherently trusts the project's internal configuration files to define legitimate build or synchronization tasks.\nThe attack flow begins when an attacker distributes a project directory containing a malicious .idea or project configuration file that defines a File Watcher. Upon opening the project in IntelliJ IDEA, the IDE reads the workspace metadata. The File Watcher mechanism, expecting legitimate Terraform-related utilities, interprets the attacker-supplied command string as a valid system process. Because the File Watcher component lacks strict allow-listing or user-confirmation prompts for project-defined binaries, it executes the payload immediately upon the triggering condition (e.g., file modification or project initialization).\nThis vulnerability effectively weaponizes the IDE's automation features, allowing an attacker to execute arbitrary binary files, scripts, or system commands on the host environment. The impact is significant, as it can lead to full system compromise, exfiltration of sensitive credentials stored within the development environment, or the installation of persistent backdoors. The vulnerability affects all versions of IntelliJ IDEA prior to 2026.3, and since the exploit relies on project metadata, it does not require network exposure or specific authentication to the IDE itself—only the opening of the malicious project folder by the target user."
}