In JetBrains IntelliJ IDEA before version 2025.2, unexpected plugin startup was possible due to the automatic start of the LSP server. This vulnerability could lead to unauthorized access and manipulation of the IDE environment, potentially compromising user data and project integrity.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-57729 |
Exploitation
To exploit this vulnerability, an attacker with local access could leverage the automatic startup of the LSP server in IntelliJ IDEA to execute unauthorized plugins. This could allow the attacker to manipulate the IDE environment and potentially access sensitive information or alter project files.
Affected Products
- JetBrains IntelliJ IDEA: A popular integrated development environment (IDE) for Java and other programming languages, which is affected by the unexpected plugin startup issue.
Mitigation
To mitigate this vulnerability, users should upgrade to JetBrains IntelliJ IDEA version 2025.2 or later, where this issue has been addressed. Additionally, users should review their plugin configurations and disable any unnecessary plugins to minimize potential attack vectors.