JetBrains has released critical security updates for its popular development tools, IntelliJ IDEA and TeamCity, addressing multiple vulnerabilities that could allow remote code execution and unauthorized access. Development teams and continuous integration (CI) administrators are strongly advised to apply these patches immediately to safeguard their environments.
IntelliJ IDEA Vulnerabilities
In IntelliJ IDEA, a critical vulnerability identified as CVE-2026-59792 involves improper handling of project workspace IDs, potentially enabling code execution through path traversal. Additionally, two high-severity issues have been addressed: CVE-2026-49366, a command injection flaw in filename completion, and CVE-2026-49367, a command execution vulnerability affecting guest accounts. Both could be exploited by attackers to execute arbitrary commands if they can manipulate project content or guest sessions.
Furthermore, several critical weaknesses in IntelliJ IDEA’s remote development feature have been patched. These include unauthorized input injection (CVE-2026-64812), unauthorized modification of settings (CVE-2026-64813), and unauthorized file access (CVE-2026-64814) during remote development sessions. These vulnerabilities pose significant risks, especially for teams exposing IDE backends over SSH or in shared environments.
TeamCity Vulnerabilities
For TeamCity, JetBrains has addressed four notable vulnerabilities. CVE-2026-65907 is a critical remote code execution flaw in Git VCS roots, allowing code execution through malicious repository configurations. Another high-severity issue, CVE-2026-65906, involves code execution via a Kotlin DSL sandbox escape in build configuration scripts. Additionally, CVE-2026-59793 addresses arbitrary file access in Perforce integration, and CVE-2026-59794 fixes a stored cross-site scripting (XSS) vulnerability in cloud profile data.
These vulnerabilities highlight the importance of securing CI/CD pipelines, as compromised version control system (VCS) integrations can be exploited to pivot from source control to build infrastructure, potentially leading to widespread system compromise.
JetBrains has released the following patched versions to address these vulnerabilities:
- IntelliJ IDEA: Versions 2026.1.4 and 2026.2
- TeamCity: Versions 2026.1.2 and 2025.11.6
Users are advised to upgrade to these versions or later to fully mitigate the identified vulnerabilities. Additionally, teams should review build configurations and VCS roots for untrusted or user-supplied scripts, limit who can define Kotlin DSL, Git, and Perforce roots, enforce project trust prompts, and monitor build logs for any suspicious script execution or unexpected agent behavior.
In the current landscape of software development, where continuous integration and deployment are integral to rapid delivery cycles, the security of development tools like IntelliJ IDEA and TeamCity is paramount. These vulnerabilities underscore the necessity for organizations to maintain vigilant patch management practices and to regularly audit their development environments for potential security risks. By promptly applying these updates and adhering to recommended security practices, development teams can significantly reduce the risk of exploitation and ensure the integrity of their software delivery pipelines.
