CVE-2026-86504

JetBrains fixed a flaw in IntelliJ IDEA where the IDE builds a project's Dev Container before asking the user to confirm that the project is trusted. If a user opens an untrusted project that ships a Dev Container configuration, the IDE proceeds to build and start the container, running its build definitions and lifecycle commands on the host machine without the expected trust confirmation. An attacker who convinces a developer to open a maliciously crafted project can therefore execute arbitrary code on that developer's host with the user's privileges, gaining high-impact confidentiality, integrity, and availability loss. Affected users are those running IntelliJ IDEA versions before 2026.2.2 who open Dev Container-configured projects from untrusted sources; the attack is local and requires user interaction, so it is not remotely exploitable on its own. There is currently no known exploitation: no public proof-of-concept, a low ~0.1% EPSS probability within 30 days, and the flaw is not in CISA's KEV catalog.

What to do: Upgrade to IntelliJ IDEA 2026.2.2 or later, which restores the project-trust confirmation before Dev Container builds. Until upgraded, avoid opening Dev Container-configured projects from untrusted sources and inspect the project's .devcontainer definitions (Dockerfile, compose files, lifecycle hooks) before opening them. No in-the-wild exploitation is currently known.