Critical Vulnerabilities in JetBrains IntelliJ IDEA and TeamCity Enable Remote Code Execution
JetBrains has addressed multiple critical vulnerabilities in its IntelliJ IDEA and TeamCity products that could allow remote code execution, unauthorized file access, and sandbox escapes. The flaws affect remote development environments and require immediate patching, especially in shared setups. In IntelliJ IDEA, CVE-2026-59792 involves directory traversal during workspace identifier processing and carries a CVSS score of up to 9.8. TeamCity received fixes for several issues, including malicious Git repository configurations that enable code execution and a Kotlin DSL sandbox escape. Additional patches cover arbitrary file access through Perforce integration and a persistent cross-site scripting flaw on cloud profile pages. Administrators are urged to update IntelliJ IDEA to versions 2026.1.4 or 2026.2 and TeamCity to 2026.1.2 or 2025.11.6 depending on the release line in use.
BoletimSecJul 27, 2026Translated from Portuguese