In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 command execution via a hidden run control in the Markdown previe…

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

In JetBrains IntelliJ IDEA before 2026.3,
2026.2.4 command execution via a hidden run control in the Markdown preview was possible

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• jetbrains.com/privacy-security/issues-fixed Diğer

Kayıt geçmişi

1. 6 Kas 2026 13:28Yayımlandı

İlgili açıklar

• 3,1 CVE-2026-123314In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 xXE attack was possible via an XML response to an HTTP Client req…
• 3,3 CVE-2026-123312In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing
• 3,3 CVE-2026-123313In JetBrains IntelliJ IDEA before 2026.3 improper checks could enable disabled plugins via external dependency settings
• 6,1 CVE-2026-123309In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 stored XSS was possible on the built-in web server via Markdown p…
• 5,4 CVE-2026-123310In JetBrains IntelliJ IDEA before 2026.3 kotlin scripts could trigger dependency downloads from arbitrary repositorie…
• 6,8 CVE-2026-123307In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configura…