CVE-2026-75056

Executive Summary

CVE-2026-75056 is an OS command injection vulnerability (CWE-78) in JetBrains IntelliJ IDEA's Markdown export tool, affecting all builds prior to 2026.2.1. A remote attacker can achieve code execution on a developer workstation by convincing the victim to open a crafted Markdown document and invoke the export functionality. The vulnerability is rated 7.8 (High) on the CVSSv3.1 scale and currently has no confirmed patch, public exploit, or CISA KEV listing.

Technical Analysis

The NVD description states: "In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible." No further implementation-level details are provided by the CNA, so the analysis below is constrained to the vulnerability class and attack mechanism rather than specific code paths.

Vulnerability mechanism. The flaw falls under CWE-78 (Improper Neutralization of Special Elements used in an OS Command, i.e., OS Command Injection). The Markdown export tool in IntelliJ IDEA constructs or invokes an OS-level command during the export workflow. Input originating from the Markdown document — whether filenames, link destinations, document metadata, or embedded formatting constructs — is processed without sufficient sanitization and is subsequently passed to an operating system shell or a command interpreter. An attacker who controls the content of a Markdown file can inject shell metacharacters, causing the IDE to execute arbitrary commands on behalf of the user.

Attack surface. Although the CVE identifier uses the term "rCE" (remote code execution), the CVSS vector (AV:L) makes clear that the actual exploitation occurs locally — the attacker supplies the malicious content remotely (e.g., via a repository, phishing attachment, or chat message), but the vulnerable command is executed on the victim's machine after the user opens the file and triggers the export. The attack surface is therefore the local IDE process and any OS shell it spawns. Because IntelliJ IDEA is a development environment, the impact of command execution extends beyond the IDE itself: developers typically run the IDE with access to source repositories, build systems, credentials, and internal network resources.

Code-level considerations. No function names, class names, or file paths are disclosed in the NVD description, and no public analysis has been published at the time of writing. At the class level, OS command injection in an export tool commonly results from one of two design flaws: (1) dynamic construction of a shell command string by concatenating user-controlled content without proper quoting/escaping, or (2) invoking an external utility (e.g., a Markdown-to-HTML converter, a PDF generator, or a document preview engine) with arguments derived from the document. In either case, the injected payload executes with the same privileges as the IDE process. Details regarding the exact injection point remain unavailable due to insufficient technical detail in the public record.

Exploitation Scenarios

No public PoC exists for CVE-2026-75056, and the absence of an exploit makes this attack chain an inference based on the vulnerability class (CWE-78) and the CVSS user-interaction requirement (UI:R). The chain is described at the class level to avoid fabricating implementation details.

1. Reconnaissance / target identification. The attacker identifies software developers or technical staff who use JetBrains IntelliJ IDEA — a target set that can be discovered through public code repositories, community profiles, and organizational footprinting. The attacker prepares a weaponized Markdown document that is plausibly relevant to the victim's work (release notes, configuration documentation, API descriptions).

2. Triggering the flawed functionality. The crafted .md file is delivered through an effective channel: a pull request to a public or internal repository, a shared documentation link, a chat message, or an email attachment. The victim opens the file in IntelliJ IDEA and invokes the Markdown export tool. Because the attack requires user interaction (UI:R), the delivery mechanism is socially engineered so that the developer has a legitimate reason to export or preview the document.

3. Payload / execution method. The malicious document contains Markdown syntax designed to inject operating system commands into the export workflow. At the vulnerability-class level, shell metacharacters such as command separators, command substitution constructs, or pipe characters are embedded in a portion of the document that the export tool passes to the OS shell. When the export routine builds and executes its command, the injected payload is interpreted by the shell, resulting in arbitrary command execution on the host. The injection succeeds because the IDE fails to neutralize or properly quote the attacker-controlled content.

4. Post-exploitation impact. Once code executes in the context of the IDE user, the attacker can harvest source code, read credentials stored in IDE configuration or environment variables, modify project files and build scripts, and use the compromised workstation as a pivot point into the internal network. In a development environment, this is particularly damaging because a compromised developer workstation can serve as a launchpad for supply chain attacks — malicious commits, tampered artifacts, or injected build-time backdoors can be pushed to downstream consumers.

Additional note: because the vulnerability is currently unpatched and no workaround has been documented by the vendor, any untrusted Markdown file opened in affected IntelliJ IDEA versions should be treated as a potential code execution vector.

Impact Assessment

CVE-2026-75056 carries a CVSSv3.1 base score of 7.8 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The component metrics inform the business risk as follows:

• AV:L (Local). The vulnerability can only be triggered on the victim's machine; the "remote" aspect comes from the attacker-controlled document, not a network-exposed service.
• AC:L (Low). No special conditions beyond opening a document and using the export tool are required; no race conditions or exotic configurations are needed.
• PR:N (None). The attacker does not need any prior access, authentication, or local user account.
• UI:R (Required). The victim must open the Markdown file and actively use the export feature, which reduces automated exploitation but does not meaningfully reduce the likelihood of success in a spear-phishing scenario.
• S:U (Unchanged). The compromise is confined to the single developer host; the confidentiality, integrity, and availability impact affect only that system's processes and data.
• C:H / I:H / A:H (High/High/High). Full disclosure of data accessible to the IDE user, full modification capability, and potential denial of service or destruction of local state.

Business impact. The primary targets are software development organizations. A single successful exploit yields complete control of a developer workstation. The blast radius extends beyond the local system because developer machines typically hold Git credentials, cloud provider keys, database connection strings, and build artifacts. Further, because IntelliJ IDEA is a cross-platform IDE, the same flaw likely impacts Windows, macOS, and Linux deployments, broadening the affected environment surface. The lack of a confirmed patch elevates this from a routine IDE bug to a standing risk for every affected installation.

Detection Guidance

The detection artifacts below are generic and must be tailored to each environment's observed baselines. Network-based detection (Suricata) is limited because the vulnerability is locally triggered; network controls can only observe the delivery of malicious Markdown files. Host-based detection (Sigma, YARA, EQL, Splunk, Wazuh) focuses on the observable event of a shell interpreter or command process being spawned by the IDE process — the most reliable behavioral indicator of this vulnerability class.

Sigma Rule

The following Sigma rule detects suspicious child processes spawned by IntelliJ IDEA processes. The parent-image values are generic examples and should be validated against the organization's actual IDE installation paths.

title: Suspicious Child Process from IntelliJ IDEA Potentially Exploiting CVE-2026-75056
id: 8d4b2f2f-6c3a-4b1a-9f7e-3c1b8a6e2d01
status: experimental
description: Detects shell interpreters or command processors spawned by JetBrains IntelliJ IDEA, potentially indicating OS command injection via the Markdown export tool (CVE-2026-75056).
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\idea64.exe'
      - '\idea.exe'
      - '\java.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\bash.exe'
      - '\sh.exe'
  selection_cmdline:
    CommandLine|contains|all:
      - 'markdown'
      - 'export'
  condition: selection_parent and selection_child and selection_cmdline
  timeframe: 10s
falsepositives:
  - Legitimate IDE functionality invoking external document conversion tools
  - Java processes unrelated to IntelliJ (tune by validating parent image paths)
level: high
tags:
  - attack.t1204
  - attack.t1059
  - cve.2026.75056

YARA Rule

The following YARA rule scans files for Markdown documents that combine document-link syntax with shell command patterns. It is intended for triage of suspicious .md files and email/repository quarantine inspection, not for detecting successful exploitation.

rule CVE_2026_75056_Markdown_Command_Injection_Triage
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects Markdown files containing potential OS command injection payloads targeting JetBrains IntelliJ IDEA export tool"
        cve = "CVE-2026-75056"
        date = "2026-05-20"
        severity = "high"
    strings:
        $md_link = "](" ascii
        $md_img = "![" ascii
        $codepragma = "```" ascii
        $shell_cmd = "cmd.exe" ascii wide nocase
        $shell_pwsh = "powershell" ascii wide nocase
        $shell_pwsh2 = "pwsh" ascii wide nocase
        $shell_bash = "bash -c" ascii wide nocase
        $shell_sh = "sh -c" ascii wide nocase
        $subst = "$(" ascii
        $semicolon = "; " ascii
        $pipe = "| " ascii
    condition:
        filesize < 5MB and
        ($md_link or $md_img) and
        2 of ($shell_cmd, $shell_pwsh, $shell_pwsh2, $shell_bash, $shell_sh, $subst, $semicolon, $pipe)
}

Suricata IDS Rule

This rule targets the delivery phase: an HTTP response carrying a Markdown file that embeds command-injection patterns. It will not detect local execution, but it can alert on the initial malicious-document transfer. The rule uses file‑data inspection, which requires Suricata to reassemble the transferred file.

alert http any any -> any any (msg:"CVE-2026-75056 Malicious Markdown Delivery with Shell Payload"; flow:established,to_client; file.data; content:".md"; file.magic; content:"text"; file.data; content:"powershell"; nocase; file.data; content:"cmd"; nocase; sentence:"PCRE shell metacharacter match"; pcre:"/(\$\(|`|;\s*(cmd|powershell|bash|sh)|\|\s*(cmd|powershell|bash|sh))/i"; classtype:attempted-user; sid:202675056; rev:1; metadata:created_at 2026_05_20, updated_at 2026_05_20;)

Note: The rule is intentionally conservative and may require tuning of the PCRE expression to reduce false positives on legitimate documentation. Network teams should test the rule against a benign Markdown corpus before production deployment.

Elastic Detection

The following EQL query correlates process-creation events where a shell interpreter is spawned by an IDE process with Markdown/export references in the command line. This is best run as an Elastic Security correlation or detection rule against Windows process event data (Sysmon Event ID 1 or Windows Event ID 4688 with process creation auditing).

process where process.parent.name in ("idea64.exe", "idea.exe", "java.exe")
  and process.name in ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe", "sh.exe")
  and (
    process.command_line like "*markdown*"
    or process.command_line like "*export*"
  )
  and (
    process.command_line like "*&&*"
    or process.command_line like "*||*"
    or process.command_line like "*;*"
    or process.command_line like "*$(*"
  )

Splunk SPL Query

The Splunk query below searches Windows Security Event 4688 (Process Creation) for the same behavioral pattern. Adjust the index and sourcetype names to match your environment — the query also works with Sysmon Event ID 1 by changing the source/sourcetype and field names.

index=windows sourcetype=WinEventLog:Security EventCode=4688
| where like(ParentProcessName, "%idea64.exe%") OR like(ParentProcessName, "%idea.exe%") OR like(ParentProcessName, "%java.exe%")
| search (NewProcessName="*cmd.exe" OR NewProcessName="*powershell.exe" OR NewProcessName="*pwsh.exe" OR NewProcessName="*bash.exe" OR NewProcessName="*sh.exe")
| where like(CommandLine, "%markdown%") OR like(CommandLine, "%export%")
| eval suspicious = if((CommandLine LIKE "%&&%" OR CommandLine LIKE "%||%" OR CommandLine LIKE "%;%" OR CommandLine LIKE "%$("), "true", "false")
| where suspicious = "true"
| table _time, host, user, ParentProcessName, NewProcessName, CommandLine
| sort - _time

For Sysmon-based ingestion, use:

index=windows source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| where like(ParentImage, "%idea64.exe%") OR like(ParentImage, "%idea.exe%") OR like(ParentImage, "%java.exe%")
| search (Image="*cmd.exe" OR Image="*powershell.exe" OR Image="*pwsh.exe" OR Image="*bash.exe" OR Image="*sh.exe")
| where like(CommandLine, "%markdown%") OR like(CommandLine, "%export%")
| table _time, host, User, ParentImage, Image, CommandLine

Wazuh OSSEC Rule

This Wazuh XML rule fires when a Sysmon process-creation event shows a shell process whose parent image is an IntelliJ IDEA executable and the command line references Markdown/export. Add this rule to the local rules file (e.g., /var/ossec/etc/rules/local_rules.xml) and restart the Wazuh manager.

<group name="sysmon,process_creation,command_execution,">
  <rule id="100750" level="12">
    <if_sid>92050</if_sid>
    <field name="win.system.eventID">^1$</field>
    <field name="win.eventdata.parentImage">(?i)(idea64|idea|java)\.exe</field>
    <field name="win.eventdata.image">(?i)(cmd|powershell|pwsh|bash|sh)\.exe</field>
    <field name="win.eventdata.commandLine">(?i).*(markdown|export).*</field>
    <description>CVE-2026-75056: Possible OS command injection via IntelliJ IDEA Markdown export tool - suspicious child process spawned</description>
    <group>cve-2026-75056,</group>
  </rule>
</group>

The rule is placed at level 12 because it is a high-confidence indicator when all conditions align, but it will require tuning based on legitimate IDE helper processes. Rule ID 100750 is an example; select an ID that does not collide with existing rules in your environment.

Mitigation & Patch Guidance

Patch status. Patch confidence is 0/4 — no patch evidence has been identified by any tracked source. The NVD description indicates that versions before 2026.2.1 are affected, which implies the fixed release is 2026.2.1, but no vendor advisory or patch bulletin has yet been confirmed at the time of writing. Organizations should verify the availability of 2026.2.1 directly with JetBrains before planning upgrades.

Immediate mitigations (while awaiting the vendor patch):

1. Treat all Markdown files received from untrusted or external sources as high risk. Do not open or export .md files from email, chat, or unvetted pull requests in IntelliJ IDEA until the patch is applied.
2. Disable or avoid using the Markdown export tool if the organizational policy permits. No official workaround disabling this feature has been published, so this is an operational mitigation, not a vendor-supported fix.
3. Run IntelliJ IDEA under a least-privilege operating system account. Do not run the IDE as administrator/root, so that any exploited process inherits minimal privileges.
4. Deploy application control (e.g., Windows AppLocker/WDAC, macOS Endpoint Security, Linux seccomp/SELinux policies) that blocks unknown child processes such as cmd.exe, powershell.exe, and sh from being spawned by IDE executables.
5. Ensure endpoints are protected by EDR solutions with behavioral detection rules such as the ones provided in the Detection Guidance section above.

Patch / upgrade steps:

1. Monitor JetBrains' official security advisories (https://www.jetbrains.com/security/) and the NVD entry for CVE-2026-75056 for an official fix announcement.
2. When the fixed build (2026.2.1 or later) is released, upgrade all IntelliJ IDEA installations. Verify distribution checksums against JetBrains' published hashes.
3. Update the IDE through the JetBrains Toolbox or the in-IDE updater, and then audit the installed version on each development workstation to ensure no affected build remains.
4. Do not assume that containerized or remote-development (JetBrains Gateway) deployments are exempt; validate the remote backend version as well.

Long-term hardening:

1. Enforce a policy of automatic IDE updates across the organization, with a change-management exception only where plugin compatibility requires pinned versions.
2. Restrict outbound egress from developer workstations to reduce the data-exfiltration potential if command execution occurs (e.g., allowlist build registries and internal endpoints only).
3. Audit and properly secure version-control credentials and cloud keys stored on developer machines; rotate credentials where compromise of developer workstations is suspected.
4. Provide security awareness guidance to developers about opening documentation files from untrusted sources, as the UI:R requirement of this CVE is the primary control an attacker must overcome.
5. Maintain visibility into developer-host process executions, and integrate the Sigma/EQL/SPL detection rules above with the organization's SIEM to enable a fast response for this and future IDE vulnerabilities.

References

1. NVD entry for CVE-2026-75056: https://nvd.nist.gov/vuln/detail/CVE-2026-75056
2. JetBrains Security — official security advisories: https://www.jetbrains.com/security/ (no specific advisory for CVE-2026-75056 located at the time of writing)
3. MITRE CWE-78 — Improper Neutralization of Special Elements used in an OS Command: https://cwe.mitre.org/data/definitions/78.html
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-75056 not listed)
5. FIRST EPSS — Exploit Prediction Scoring System: https://www.first.org/epss/ (CVE-2026-75056 not yet scored)

No public exploit code, PoC, or in-the-wild exploitation evidence has been observed for CVE-2026-75056 at the time of writing. No threat-actor campaigns have been attributed to this vulnerability. Readers should revisit the NVD and JetBrains security pages regularly for updates, as the patch status (currently 0/4, unpatched) may change.