PatchSiren cyber security CVE debrief

CVE-2026-49366 JetBrains CVE debrief

A command injection vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2026.1.1. The flaw occurs during filename completion, where unsanitized input can be injected into system commands. This is classified as CWE-78 (OS Command Injection). The CVSS 3.1 score of 7.8 (HIGH) reflects local attack vector, low attack complexity, no privileges required, but user interaction needed, with high impacts to confidentiality, integrity, and availability. The vulnerability was published to NVD on 2026-05-29 and remains under analysis. JetBrains has addressed this issue in version 2026.1.1.

Vendor: JetBrains
Product: IntelliJ IDEA
CVSS: HIGH 7.8
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-05-29
Original CVE updated: 2026-05-29
Advisory published: 2026-05-29
Advisory updated: 2026-05-29

Who should care

Organizations using JetBrains IntelliJ IDEA for software development, particularly those working with untrusted codebases or files from external sources. Development teams relying on IDE filename completion features should prioritize patching.

Technical summary

The vulnerability stems from improper neutralization of special elements used in OS commands (CWE-78) within the filename completion feature of IntelliJ IDEA. When a user triggers filename completion, malicious input embedded in filenames or paths could be executed as system commands. The attack requires local access and user interaction (e.g., triggering completion on a crafted filename), but no special privileges. Successful exploitation yields high impact across confidentiality, integrity, and availability dimensions.

Defensive priority

HIGH

Recommended defensive actions

Upgrade JetBrains IntelliJ IDEA to version 2026.1.1 or later
Review filename completion workflows for unusual behavior
Monitor JetBrains security advisories for additional updates
If immediate patching is not possible, exercise caution with filename completion in untrusted projects

Evidence notes

Vulnerability confirmed by JetBrains security advisory. CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. CWE-78 classification from primary source.

Official resources

2026-05-29T19:16:26.313Z