CVE-2024-46970: JetBrains IntelliJ IDEA XSS Vulnerability

CVE-2024-46970 Overview

CVE-2024-46970 is an HTML injection vulnerability affecting JetBrains IntelliJ IDEA versions prior to 2024.1. The flaw allows an attacker to inject arbitrary HTML content through a crafted project name. When a developer opens or previews the project inside the IDE, the injected markup renders in the affected interface component. The issue is classified under Improper Neutralization of Input During Web Page Generation [CWE-79]. Exploitation requires user interaction, and impact is limited to low confidentiality and integrity effects. JetBrains addressed the issue in IntelliJ IDEA 2024.1.

Critical Impact
An attacker can inject HTML content through the project name field, which renders in IntelliJ IDEA and enables client-side content manipulation against developers who open the malicious project.

Affected Products

JetBrains IntelliJ IDEA versions before 2024.1
JetBrains IntelliJ IDEA Community Edition (pre-2024.1)
JetBrains IntelliJ IDEA Ultimate Edition (pre-2024.1)

Discovery Timeline

2024-09-16 - CVE-2024-46970 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-46970

Vulnerability Analysis

The vulnerability resides in how IntelliJ IDEA processes and renders the project name string in IDE UI components that support HTML markup. The IDE fails to properly neutralize HTML characters before rendering the value in Swing-based UI panels. An attacker who controls the project name can embed HTML tags that the IDE interprets as markup rather than literal text.

Exploitation targets developers who clone, import, or open a malicious project. The attack vector is network-adjacent through project distribution channels such as Git repositories, project archives, or shared workspace files. Successful injection can alter what the developer sees in IDE dialogs, project trees, or notification popups.

The scope of impact is limited compared to browser-based cross-site scripting. IntelliJ's HTML renderer does not execute JavaScript in the same manner as a web browser, but attackers can still manipulate displayed content, embed misleading links, or trigger user actions through crafted markup.

Root Cause

The root cause is missing output encoding when the project name is rendered inside HTML-capable Swing components. The IDE treats the project name as trusted display text without escaping angle brackets and other HTML metacharacters. This aligns with the [CWE-79] weakness pattern of improper neutralization of input during web page generation.

Attack Vector

An attacker distributes a project whose name field contains crafted HTML. When a victim opens the project in a vulnerable version of IntelliJ IDEA, the IDE renders the injected markup. The attack requires user interaction, specifically the developer choosing to open or import the malicious project. No authentication or elevated privileges are required from the attacker.

The vulnerability mechanism involves unsanitized string interpolation into HTML contexts within IDE UI elements. See the JetBrains Security Issues Fixed advisory for vendor confirmation.

Detection Methods for CVE-2024-46970

Indicators of Compromise

Project configuration files or repository metadata containing HTML tags such as <img>, <a href>, or <script> embedded in the project name field.
Unexpected IDE dialogs, tooltips, or notification popups displaying formatted content, hyperlinks, or images sourced from project metadata.
Repository clones from untrusted sources where the .idea/.name file or equivalent project descriptor contains encoded markup.

Detection Strategies

Inspect project metadata files under the .idea/ directory for HTML characters in the project name string before opening unknown projects.
Audit developer workstation logs for IntelliJ IDEA version strings below 2024.1 to identify systems that remain exposed.
Scan Git repositories and shared project archives for suspicious project name values as part of code intake review.

Monitoring Recommendations

Track IDE version inventory across developer endpoints and flag hosts running IntelliJ IDEA below 2024.1.
Monitor endpoint telemetry for IntelliJ IDEA processes spawning unexpected network connections or child processes after opening new projects.
Log project open events on managed developer workstations to correlate with reports of unusual IDE UI behavior.

How to Mitigate CVE-2024-46970

Immediate Actions Required

Upgrade all IntelliJ IDEA installations to version 2024.1 or later, which contains the vendor patch.
Restrict developers from opening projects sourced from untrusted repositories, archives, or unknown contributors.
Communicate the issue to development teams and confirm that automated update policies are enforced across managed endpoints.

Patch Information

JetBrains resolved this issue in IntelliJ IDEA 2024.1. The fix introduces proper HTML encoding of project name values before they are rendered in IDE UI components. Refer to the JetBrains Security Issues Fixed page for the official vendor entry.

Workarounds

Manually review the project name field in .idea/.name or the project descriptor file before opening projects from unverified sources.
Standardize project intake through a code review process that inspects repository metadata for HTML characters.
Enforce enterprise update policies through JetBrains Toolbox or endpoint management to keep IDE versions current.

bash

# Verify installed IntelliJ IDEA version on Linux/macOS
idea --version

# Windows PowerShell: query installed JetBrains IDE versions
Get-ChildItem "$env:LOCALAPPDATA\JetBrains\Toolbox\apps\IDEA-U\ch-0" | Select-Object Name