In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
CWE-94