Description

In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.8",
  "pubDate": "2026-09-07T17:17:28.560Z",
  "pubdate": "2026-09-07T17:17:28.560Z",
  "executiveSummary": "A sensitive information disclosure vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2026.2.2.\nThe vulnerability involves the unintentional logging of terminal command input into the application's internal diagnostic log file, idea.log.\nThis flaw allows unauthorized access to potentially sensitive data, such as credentials, API tokens, or internal path structures, provided an attacker has local access to the filesystem where logs are stored.\nThe risk implication is elevated for shared environments or systems with weak file-system permissions, as the terminal input is persisted in plaintext within the log directory.\nNo specific authentication or network-based interaction is required by the attacker; the primary requirement is the ability to read the log files generated by the affected application instance.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper handling of input streams captured within the integrated terminal component of IntelliJ IDEA. The application's diagnostic subsystem incorrectly intercepts and writes raw command-line input strings provided by the user directly into the persistent application log file, idea.log.\nThe vulnerable component is the terminal emulator integration within the IDE, which failed to sanitize or exclude terminal input buffers from the logging framework. In affected versions (pre-2026.2.2), any command entered into the embedded terminal is processed by the terminal emulator and subsequently dispatched to the logging utility for troubleshooting or debugging purposes.\nExploitation does not require elevated privileges or remote network access; it is an issue of local information exposure. An attacker, or a malicious process with sufficient filesystem read permissions, can parse the idea.log file to reconstruct the user's terminal session history. This includes commands containing sensitive environmental variables, passwords passed as CLI arguments, SSH connection strings, or cloud provider secret keys.\nThe attack flow proceeds as follows: 1) The user interacts with the IDE's terminal to execute various system commands. 2) The terminal component transmits the input buffer to the logging service. 3) The logging service appends the input to the idea.log file located within the IDE's system configuration or log directory. 4) An adversary gains access to the log file, either through physical access, local malware, or an insecure misconfiguration in the operating system. 5) The adversary parses the file for high-entropy strings or sensitive command patterns, leading to credential harvesting or lateral movement.\nThe post-exploitation impact includes unauthorized credential acquisition and exposure of sensitive operational workflows, which can be leveraged to compromise further infrastructure or sensitive source code repositories accessed by the user."
}