JetBrainsCVE-2026-64815

JetBrains IntelliJ IDEA: code injection

High8.1CVE-2026-64815 · Published Jul 23, 2026 · updated Jul 28, 2026

In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files

JetBrains advisory

Affected versions

Package	Affected	Fixed in
IntelliJ IDEA Product	< 2026.2	2026.2

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-94

More JetBrains advisories

Date	Advisory	Severity	Fixed in
Jul 23	JetBrains TeamCity: code injection High8.8Jul 23 CVE-2026-659062026.1.2+1 more	High8.8	2026.1.2+1 more
Jul 23	JetBrains TeamCity: code execution Critical9.1Jul 23 CVE-2026-659072026.1.2+1 more	Critical9.1	2026.1.2+1 more
Jul 23	JetBrains PyCharm: code execution High8.6Jul 23 CVE-2026-659082026.1.4+1 more	High8.6	2026.1.4+1 more
Jul 23	JetBrains IntelliJ IDEA: missing authorization High8.6Jul 23 CVE-2026-648142026.2	High8.6	2026.2
Jul 23	JetBrains WebStorm: code execution High8.4Jul 23 CVE-2026-648062026.2	High8.4	2026.2
Jul 23	JetBrains WebStorm: code execution High7.8Jul 23 CVE-2026-648072026.2	High7.8	2026.2

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.