JetBrains has released security updates to address a critical code execution vulnerability in IntelliJ IDEA, alongside four high-severity vulnerabilities in TeamCity.
Development teams and CI administrators are urged to apply these patches immediately to prevent potential remote attacks. JetBrains published a security advisory that details multiple issues across its IDE and server products, including IntelliJ IDEA and TeamCity, with several issues classified as critical or high severity.
The fixes are included in IntelliJ IDEA versions 2026.1.4 and 2026.2, as well as TeamCity versions 2026.1.2 and 2025.11.6. Users are advised to upgrade to these versions or later to address the identified vulnerabilities fully.
Among the critical vulnerabilities in IntelliJ IDEA, one significant flaw is related to project workspace ID handling, tracked as CVE-2026-59792. This flaw allows for code execution via path traversal during workspace ID processing.
JetBrains Fixes Critical Vulnerabilities
Additionally, JetBrains has patched a high-risk command injection vulnerability in filename completion (CVE-2026-49366) and another high-risk command execution flaw affecting guest accounts (CVE-2026-49367). Both of these vulnerabilities enable attackers to execute arbitrary commands if they can influence project content or guest sessions.
The advisory also highlights several critical weaknesses in remote development within IntelliJ IDEA, including unauthorized input injection (CVE-2026-64812) and unauthorized modification of settings (CVE-2026-64813) during Remote Development sessions.
Another related high-severity issue (CVE-2026-64814) allowed unauthorized file access within the same Remote Development context, which significantly escalates the risk for teams exposing IDE backends over SSH or in shared environments.
On the CI side, JetBrains has addressed four notable vulnerabilities in TeamCity, including a critical remote code execution flaw in Git VCS roots (CVE-2026-65907). This flaw allows for code execution through malicious repository configuration.
Another high-severity issue (CVE-2026-65906) involves code execution via a Kotlin DSL sandbox escape in build configuration scripts. Additionally, CVE-2026-59793 and CVE-2026-59794 address arbitrary file access in Perforce integration and stored XSS in cloud profile data, respectively.
CVE-2026-65907 (TeamCity Git VCS roots) falls under CWE-94 (Code Injection), enabling attackers to achieve remote code execution through crafted Git root settings on vulnerable TeamCity servers.
CVE-2026-65906 (TeamCity Kotlin DSL sandbox escape) and CVE-2026-59793 (arbitrary file access in Perforce) demonstrate that compromised VCS integrations can be exploited to pivot from source control to build infrastructure.
For IntelliJ IDEA, the critical workspace ID path traversal issue (CVE-2026-59792) has been fixed in versions 2026.1.4 and 2026.2. Users of older 2026.1.x and 2025 branches remain vulnerable and need to upgrade.
For TeamCity, CVE-2026-65906 and CVE-2026-65907 have been resolved in TeamCity versions 2026.1.2 and 2025.11.6, along with patches for the arbitrary file access and XSS issues.
JetBrains recommends that users immediately upgrade to the patched versions of IntelliJ IDEA and TeamCity. Teams should also review build configurations and VCS roots for untrusted or user-supplied scripts.
Additionally, security-conscious teams should limit who can define Kotlin DSL, Git, and Perforce roots, enforce project trust prompts, and monitor build logs for any suspicious script execution or unexpected agent behavior.
