Description

In JetBrains IntelliJ IDEA before 2026.2.1 xXE was possible in the Eclipse settings importers

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.5",
  "pubDate": "2026-08-17T16:17:52.977Z",
  "pubdate": "2026-08-17T16:17:52.977Z",
  "executiveSummary": "An XML External Entity (XXE) vulnerability exists in JetBrains IntelliJ IDEA prior to version 2026.2.1 within the Eclipse settings importers component. The flaw arises from insecurely configured XML parsing mechanisms when processing imported Eclipse configuration files. Successful exploitation of this vulnerability allows an attacker to achieve unauthorized access to local files residing on the target system, potentially leading to the disclosure of sensitive information. The risk implications include the compromise of confidentiality where an attacker could exfiltrate internal system data accessible to the user running the IDE process. To exploit this vulnerability, an attacker must induce a victim to import a maliciously crafted Eclipse settings file containing malicious XML external entity definitions or references. No specific network exposure or advanced authentication requirements are inherently mandated for the local import vector, relying instead on user interaction to process the untrusted configuration input.",
  "technicalDetails": "The vulnerability resides within the Eclipse settings importers component of JetBrains IntelliJ IDEA, specifically affecting versions prior to 2026.2.1. The root cause of the issue is the failure of the underlying XML parsing library to properly disable or restrict the resolution of external entities, general entities, and external document type definitions (DTDs) when parsing configuration data.\nThe vulnerable component processes XML-based Eclipse settings files provided by the user during the import workflow. When an untrusted configuration file is supplied, the XML parser evaluates structural declarations within the input. If the parser is configured without adequate defenses against XML External Entity injections, it will process maliciously constructed DOCTYPE declarations that define external entities pointing to local file paths or internal network resources.\nThe attack flow proceeds as follows: First, an attacker crafts a malicious Eclipse settings file incorporating an XML payload with a custom entity declaration referencing a sensitive file on the target host, such as via file:// URI schemes. Second, the attacker distributes this file to the target user through social engineering or other delivery mechanisms. Third, the victim initiates the import process within JetBrains IntelliJ IDEA, selecting the malicious configuration file. Fourth, the IDE invokes the Eclipse settings importers component, which parses the untrusted XML file without disabling external entity resolution. Fifth, the XML parser resolves the malicious external entity by reading the targeted local file from the underlying filesystem. Finally, depending on the parser configuration and error handling, the contents of the retrieved file may be reflected back to the attacker via error messages, or utilized in Server-Side Request Forgery (SSRF) scenarios if network-based entity resolution is supported.\nThe vulnerability affects local execution contexts where user interaction is required via the IDE import functionality. Privilege requirements are limited to the standard permissions of the user executing the IntelliJ IDEA instance. The post-exploitation impact includes the potential unauthorized disclosure of local files readable by the application process context."
}