JetBrains Patches 18 Flaws, Including Two CVSS 10 Bugs in IntelliJ IDEA Remote Development

TL;DR

JetBrains fixed 18 vulnerabilities across GoLand, IntelliJ IDEA, PhpStorm, PyCharm, TeamCity, and WebStorm. Two IntelliJ IDEA flaws in Remote Development sessions carry a maximum CVSS score of 10. A TeamCity issue in Git VCS roots follows at CVSS 9.1.

Notable CVEs

Why It Matters

Developer workstations hold source code, cloud tokens, and signing keys. An IDE that runs code from an untrusted project therefore becomes an attractive first step into a software supply chain.

TeamCity raises the stakes further, since a build server touches every artifact a team ships.

How the Attacks Work

Project Trust Bypasses

Most of these JetBrains vulnerabilities share one pattern. Simply opening a malicious project could trigger code execution before the IDE ever asked the user to trust it. Attack paths ran through configured interpreters, SDKs, linters, package-manager tooling, and development container configs.

Remote Development Gaps

The two CVSS 10 issues sit elsewhere. CVE-2026-64812 allowed unauthorized input injection in a Remote Development session, and CVE-2026-64813 allowed unauthorized settings changes. Both stem from missing authentication and unsafe defaults. A related flaw, CVE-2026-64814, allowed unauthorized file access.

Build Server Issues

TeamCity carries two. CVE-2026-65907 permitted code execution through Git VCS roots, while CVE-2026-65906 allowed a Kotlin DSL sandbox escape. Antoni Tremblay reported the latter, plus three WebStorm bugs.

Affected Versions

JetBrains lists fix versions rather than affected ranges. Treat any build older than the fix as vulnerable.

• GoLand, IntelliJ IDEA, PhpStorm, WebStorm: fixed in 2026.2.
• PyCharm: fixed in 2026.1.4 and 2026.2.
• TeamCity: fixed in 2026.1.2 and 2025.11.6.

Patch and Mitigation

Update through the Toolbox App or your IDE’s built-in updater. TeamCity administrators should patch first, given the build server’s blast radius.

Until you update, avoid opening untrusted repositories, and keep Remote Development backends off public networks. JetBrains publishes the full table on its security issues fixed page.

No public proof-of-concept exists for any of these JetBrains vulnerabilities, and nobody has confirmed exploitation in the wild.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.