CVE-2026-49383
LOW 3.3In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
NO EXPLOITATION SIGNALS
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.1%chance of exploitation in 30 days · 1st percentile
○ In CISA KEV
○ Public exploit / PoC
Impact if exploited
3.3CVSS 3.1 · LOW
- ConfidentialityLow
- IntegrityNone
- AvailabilityNone
What an attacker needs
- ⚠Access: Requires local access to the host
- ✓Privileges: No account or privileges required
- ⚠User interaction: A user must take an action (click / open a file)
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Weakness (CWE)
- CWE-611: XML external entity (XXE)
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N