Description

In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-07T17:17:29.020Z",
  "pubdate": "2026-09-07T17:17:29.020Z",
  "executiveSummary": "A vulnerability exists in JetBrains IntelliJ IDEA prior to version 2026.2.2 involving a failure to enforce project-trust constraints. This security oversight results in the unauthorized leakage of sensitive project metadata to the JetBrains Marketplace.\nThe vulnerability is characterized as an improper access control or missing authorization check. The primary impact is the exfiltration of potentially proprietary or sensitive information contained within project files during interactions with the marketplace infrastructure.\nAffected products include IntelliJ IDEA versions preceding 2026.2.2. The risk is significant for developers or organizations maintaining private, sensitive, or intellectual property-heavy projects, as metadata could be harvested without the user's explicit consent or trust validation.\nExploitation requires no complex authentication or high-privilege access, as the vulnerability resides in the automated handshake process between the local IDE environment and the remote service. Attackers or malicious actors monitoring marketplace interactions could leverage this metadata leakage to perform reconnaissance, facilitate supply-chain attacks, or identify targets based on specific technology stacks or internal project structures defined within the metadata.",
  "technicalDetails": "The root cause of this vulnerability is a missing project-trust check during the communication handshake between IntelliJ IDEA and the JetBrains Marketplace. In IntelliJ IDEA, the 'Project Trust' mechanism is designed to prevent the execution of untrusted code or the leakage of sensitive configuration data when a project is first opened or originates from an untrusted source.\nIn the affected versions, the IDE fails to verify the 'Trusted' status of a project before initiating telemetry or metadata exchange procedures with the JetBrains Marketplace. Normally, if a project is not marked as trusted, the IDE should restrict interactions that could expose local file structures, configuration settings, or project-specific environmental variables. By bypassing this verification logic, the IDE facilitates an automated export of project metadata to the marketplace API.\nThe attack flow initiates when a user opens an untrusted project directory. Because the internal security gate (the project-trust mechanism) is ignored, the IDE proceeds to perform routine marketplace interactions. This includes sending headers or payload data that characterize the current project environment. The intercepted metadata may include file paths, dependency configurations, plugin requirements, and project identifiers. These details are transmitted over the standard communication protocols used by the IDE to synchronize with JetBrains services.\nThe vulnerability resides within the integration layer between the core IDE environment and the JetBrains Marketplace service modules. It does not require local authentication, as the IDE is already authenticated to the JetBrains service. Furthermore, no specific network positioning is required beyond the ability to intercept or log the standard outbound traffic generated by the IDE when it communicates with the marketplace infrastructure.\nPost-exploitation, the exposed metadata provides a roadmap for an attacker to understand the architecture of the developer's environment. By analyzing the leaked project metadata, an attacker can identify vulnerable plugins, specific build tools, or proprietary directory structures, which can be used to refine subsequent attack vectors against the local developer machine or the wider software supply chain. The lack of validation ensures that these details are transmitted regardless of whether the user intended to associate the untrusted project with the marketplace."
}