CVE-2026-49382: JetBrains IntelliJ IDEA RCE Vulnerability

CVE-2026-49382 Overview

CVE-2026-49382 affects JetBrains IntelliJ IDEA versions before 2026.1. The vulnerability enables code execution through template injection in the Copyright plugin. An attacker can craft a malicious template that executes arbitrary code when processed by the affected component. The flaw is classified under [CWE-1336] (Improper Neutralization of Special Elements Used in a Template Engine).

Exploitation requires local access and user interaction, typically through opening a project containing a malicious copyright profile configuration. JetBrains addressed the issue in IntelliJ IDEA 2026.1.

Critical Impact

Successful exploitation allows arbitrary code execution in the context of the developer running IntelliJ IDEA, compromising source code, credentials, and any system the IDE can access.

Affected Products

• JetBrains IntelliJ IDEA versions prior to 2026.1
• All editions (Community and Ultimate) using the bundled Copyright plugin
• Development environments processing untrusted project configurations

Discovery Timeline

• 2026-05-29 - CVE-2026-49382 published to the National Vulnerability Database (NVD)
• 2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-49382

Vulnerability Analysis

The Copyright plugin in IntelliJ IDEA generates and maintains copyright headers across project files. The plugin uses a template engine that evaluates expressions to populate dynamic fields such as the current date, file name, and author. The vulnerability stems from improper neutralization of special elements in template input, which permits expression evaluation beyond the intended scope.

An attacker who controls a copyright profile, typically stored in .idea/copyright/ within a project, can embed template expressions that resolve to arbitrary method calls. When the IDE processes the template during file creation, header insertion, or template preview, the engine executes the embedded expressions.

The attack vector is local and requires user interaction, since the victim must open the malicious project and trigger template processing. Successful exploitation runs code with the privileges of the developer.

Root Cause

The root cause is unsafe evaluation of user-controlled template input inside the Copyright plugin. The template engine fails to restrict the set of accessible methods and classes, allowing template expressions to reach runtime APIs capable of executing system commands or loading arbitrary code.

Attack Vector

An attacker distributes a project, repository, or shared workspace that includes a crafted copyright profile. When a developer opens the project in a vulnerable version of IntelliJ IDEA and the IDE processes the template, the injected expression executes. Common delivery channels include public Git repositories, pull requests adding copyright configurations, and shared template archives.

The vulnerability mechanism is documented in the JetBrains Security Issues Fixed advisory. No proof-of-concept code is publicly available at this time.

Detection Methods for CVE-2026-49382

Indicators of Compromise

• Unexpected child processes spawned by idea64.exe, idea, or the JetBrains java/jbr runtime shortly after opening a project
• Modifications to files under .idea/copyright/ containing template expressions referencing runtime classes such as Runtime, ProcessBuilder, or groovy.lang
• Outbound network connections initiated by the IDE process to unfamiliar hosts after project import
• New scheduled tasks, cron entries, or persistence artifacts created by the developer account around the time a project was opened

Detection Strategies

• Inspect .idea/copyright/profiles_settings.xml and related XML files in repositories for template expressions invoking Java reflection or process APIs
• Hunt for IntelliJ IDEA processes executing shells (cmd.exe, powershell.exe, /bin/sh, /bin/bash) without a corresponding terminal plugin action
• Correlate file write events in .idea/copyright/ with subsequent process creation events
• Review installed IDE versions across developer endpoints and flag any IntelliJ IDEA build earlier than 2026.1

Monitoring Recommendations

• Enable command-line auditing on developer workstations to capture process arguments spawned by IDE processes
• Forward IDE process telemetry, file integrity events, and network connections to a centralized analytics platform for correlation
• Alert on git commits that introduce or modify copyright profile configurations in monitored repositories
• Track plugin and IDE version inventory to identify hosts still running vulnerable releases

How to Mitigate CVE-2026-49382

Immediate Actions Required

• Upgrade IntelliJ IDEA to version 2026.1 or later on all developer workstations and build agents
• Audit existing projects for unexpected entries in .idea/copyright/ and remove suspicious template expressions
• Treat copyright profile changes from untrusted contributors as security-relevant during code review
• Restrict opening of untrusted projects until patching is complete, or open them in JetBrains Safe Mode

Patch Information

JetBrains released a fix in IntelliJ IDEA 2026.1. Refer to the JetBrains Security Issues Fixed page for the canonical advisory and release notes. Update through the IDE's Toolbox App, JetBrains Toolbox, or by downloading the latest installer from the vendor.

Workarounds

• Disable the bundled Copyright plugin from Settings > Plugins until the IDE can be upgraded
• Enable Trusted Projects and decline trust for any repository received from an external source
• Block IDE child process execution of shells and scripting interpreters through endpoint policy where feasible
• Remove or quarantine any .idea/copyright/ directories included in third-party project archives before opening them

# Verify installed IntelliJ IDEA version on Linux/macOS
idea --version

# Quick scan for suspicious template expressions in repositories
grep -rIE "Runtime|ProcessBuilder|groovy\.lang|java\.lang\.Class" .idea/copyright/ 2>/dev/null

# Remove untrusted copyright configurations before opening a project
rm -rf .idea/copyright/