First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-123853

HighCVSS 7.8/10Last modified Nov 7, 2026

Description

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
JetBrains	IntelliJ IDEA	< 2026.3, 2026.2.2

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Timeline

Published: Nov 6, 2026
Last modified: Nov 7, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1238545.5In JetBrains PyCharm before 2026.3 code execution was possible in Safe Mode via a crafted Jupyter notebook widget module CVE-2026-1238557.5In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs CVE-2026-1238566.5In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server CVE-2026-1238574.3In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetection CVE-2026-1238584.4In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projects CVE-2026-1238598.1When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake Con CVE-2026-123863.9Improper null termination vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Pen allows Overflow Buffers. This CVE-2026-1238605.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allo CVE-2026-1238615.3Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchi CVE-2026-1238622.9An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib CVE-2026-1238638.2A reachable assertion in Node.js HTTP/2 session teardown lets any unauthenticated client abort the server, over both TLS and cleartext. A cl CVE-2026-1238648.1A re-entrancy flaw in Node.js HTTPS lets an unauthenticated client read memory belonging to other connections, including TLS private keys an

CVE-2026-123853: High severity, CVSS 7.8 | Vulnix