In JetBrains IntelliJ IDEA before 2025.2, unexpected plugin startup was possible due to automatic LSP server start. This vulnerability can lead to unauthorized access and potential exploitation of the system. Users are advised to update their software to mitigate risks associated with this issue.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2025-57729 |
Exploitation
To exploit this vulnerability, an attacker with local access can leverage the automatic startup of the LSP server to execute unauthorized plugins. This requires a high level of access complexity but can lead to significant impacts on confidentiality and integrity.
Affected Products
- JetBrains IntelliJ IDEA: A popular integrated development environment (IDE) that may allow unauthorized plugin execution due to this vulnerability.
Mitigation
Users should update to the latest version of JetBrains IntelliJ IDEA to ensure that the vulnerability is patched. Regularly checking for updates and applying security patches is essential to maintain system integrity.