CVE-2025-57729
Jetbrains Intellij Idea ≤ 2025.2
Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:LSummary
CVE-2025-57729 is a medium-severity Inclusion of Functionality from Untrusted Control Sphere (CWE-829) vulnerability in Jetbrains Intellij Idea. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to CM-11 (User-installed Software) and CM-7 (Least Functionality) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25410
Vulnerability Data
In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
- 6 hardening rules · 6 OS baselines
V14.2.3V3.5.6V9.1.3V15.3.2
Mitigating Controls (NIST 800-53 r5) AI
Least Functionality directly blocks automatic startup of the unneeded LSP server component that enables the unexpected plugin execution in IntelliJ IDEA.
User-installed Software control governs plugin installation and execution, preventing automatic loading of untrusted LSP/plugin code from outside the approved control sphere.
Malicious Code Protection mechanisms can scan or sandbox the automatically started LSP server/plugin before it executes, mitigating the CWE-829 inclusion risk.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Pre-acquisition integrity/authenticity checks directly prevent inclusion of untrusted code.
Supply-chain program directly governs inclusion of third-party executable code.
Contractual requirements can mandate trusted sources and integrity checks for included functionality.
Supplier risk assessment explicitly covers risks from their products and libraries.
Critical-supplier assessment reduces risk of importing executable functionality from untrusted parties.
Secure SDLC practices include dependency vetting and trusted-source policies.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
By requiring suppliers to propagate security requirements and to disclose component provenance, the control limits the inclusion of functionality obtained from untrusted third-party sources without oversight.
Blocking domains that serve malware or untrusted scripts prevents the browser from automatically including functionality from an attacker-controlled source.