CVE-2026-49383

LowCVSS 3.3

Published: 29/05/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.11%

1th percentile - higher than 1% of all known CVEs

In JetBrains IntelliJ IDEA before 2026.1, the UI Designer form parser is vulnerable to XXE (XML External Entity) attacks.

Attackers could read local files, perform SSRF, or cause denial of service via malicious XML.

Upgrade IntelliJ IDEA to version 2026.1 or later.

Original NVD description (English source)

In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible