CVE-2025-57729 Overview
CVE-2025-57729 affects JetBrains IntelliJ IDEA versions before 2025.2. The vulnerability allows unexpected plugin startup because the IDE automatically starts a Language Server Protocol (LSP) server. An attacker with local, low-privileged access can trigger plugin execution without user interaction, compromising confidentiality and integrity on the developer workstation. The issue is tracked under CWE-829: Inclusion of Functionality from Untrusted Control Sphere.
Critical Impact
Automatic LSP server startup can execute plugin code from an untrusted source, exposing project files and IDE state on the affected workstation.
Affected Products
- JetBrains IntelliJ IDEA versions prior to 2025.2
- Installations that load third-party or workspace-supplied plugins
- Developer workstations relying on default LSP configuration
Discovery Timeline
- 2025-08-20 - CVE-2025-57729 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-57729
Vulnerability Analysis
The vulnerability originates in how IntelliJ IDEA handles Language Server Protocol integrations. Before version 2025.2, the IDE started LSP servers automatically when opening a project. This automatic startup path also triggered unexpected plugin initialization, bypassing the user's intent to review or approve executable components.
Because LSP servers can execute binaries defined in workspace or plugin configuration, attackers who influence project contents can cause the IDE to launch attacker-controlled code. The flaw maps to [CWE-829], where functionality is included from an untrusted control sphere without proper validation.
The attack requires local access with low privileges but no user interaction beyond opening a project. Successful exploitation impacts confidentiality and integrity on the host running IntelliJ IDEA.
Root Cause
The root cause is the IDE's default behavior of auto-starting LSP servers during plugin initialization. IntelliJ IDEA did not require explicit user confirmation before launching LSP-linked plugin processes. Workspace-scoped configuration was treated with the same trust as user-installed components.
Attack Vector
An attacker delivers a crafted project or plugin bundle to a developer. When the developer opens the project in a vulnerable IntelliJ IDEA build, the automatic LSP startup executes the bundled server. Because the process runs with the developer's privileges, it can read source code, credentials in the workspace, and modify project files. See the JetBrains security advisory for the vendor's technical description.
Detection Methods for CVE-2025-57729
Indicators of Compromise
- Unexpected child processes spawned by idea64.exe, idea, or idea.sh shortly after opening a project
- LSP server binaries executing from project-local directories such as .idea/, node_modules/, or workspace temp folders
- Outbound network connections initiated by IDE child processes to unfamiliar hosts
- New or modified plugin descriptors under the IntelliJ configuration directory
Detection Strategies
- Baseline expected LSP server executables per project type and alert on deviations
- Monitor process creation events where the parent is IntelliJ IDEA and the child executes from a user-writable path
- Correlate IDE process launches with file writes to sensitive locations such as SSH keys or credential stores
Monitoring Recommendations
- Enable endpoint process telemetry on developer workstations and forward to a centralized analytics platform
- Track IntelliJ IDEA version inventory to identify hosts running builds prior to 2025.2
- Review LSP configuration files committed to shared repositories for suspicious executable paths
How to Mitigate CVE-2025-57729
Immediate Actions Required
- Upgrade IntelliJ IDEA to version 2025.2 or later on all developer workstations
- Audit installed plugins and remove any that are unused or unverified
- Restrict developer accounts from running with local administrator privileges when possible
Patch Information
JetBrains addressed CVE-2025-57729 in IntelliJ IDEA 2025.2. The patch removes the automatic LSP server startup path that triggered unexpected plugin initialization. Fix details are listed in the JetBrains Security Issues Fixed page.
Workarounds
- Disable LSP-based plugins until the IDE is updated to 2025.2
- Avoid opening untrusted projects in vulnerable IntelliJ IDEA builds
- Use JetBrains Toolbox to enforce IDE version compliance across engineering teams
# Verify the installed IntelliJ IDEA version on Linux/macOS
idea --version
# Windows: check version via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\JetBrains\IntelliJ IDEA\*" | Select-Object DisplayVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
