CVE-2025-57729

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-829

Affected software

VendorProductVersions
JetBrainsIntelliJ IDEA< 2025.2

References

Timeline

Published
Aug 20, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-577304.6In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development featureCVE-2025-577315.4In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram contentCVE-2025-577326.3In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownershipCVE-2025-577333.8In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email contentCVE-2025-577346.5In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script filesCVE-2025-577359.1When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case itCVE-2025-577387.2Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations CVE-2025-577398.8An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet ForCVE-2025-577408.8An Heap-based Buffer Overflow vulnerability [CWE-122] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below,CVE-2025-577417.8An Incorrect Permission Assignment for Critical Resource vulnerability [CWE-732] in FortiClientMac 7.4.0 through 7.4.3, 7.2.0 through 7.2.11CVE-2025-577496.5n8n is a workflow automation platform. Before 1.106.0, a symlink traversal vulnerability was discovered in the Read/Write File node in n8n. CVE-2025-577517.7pyLoad is the free and open-source Download Manager written in pure Python. The jk parameter is received in pyLoad CNL Blueprint. Due to the
CVE-2025-57729: High severity, CVSS 7.3 | Vulnix