CVE-2024-5899: Improper trust check in Bazel Build intellij plugin

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-18 · updated 2026-06-17
Weakness: CWE-862

Description

When Bazel Plugin in intellij imports a project (either using "import project" or "Auto import") the dialog for trusting the project is not displayed. This comes from the fact that both call the method ProjectBuilder.createProject which then calls ProjectManager.getInstance().createProject. This method, as its name suggests is intended to create a new project, not to import an existing one. We recommend upgrading to version 2024.06.04.0.2 or beyond for the IntelliJ, CLion and Android Studio Bazel plugins.

Affected products

Google Bazel For Android Studio: before 2024.06.04.0.2 — fixed in 2024.06.04.0.2
Google Bazel For Clion: before 2024.06.04.0.2 — fixed in 2024.06.04.0.2
Google Bazel For Intellij: before 2024.06.04.0.2 — fixed in 2024.06.04.0.2

How to fix

Upgrade to a fixed version: Google Bazel For Android Studio 2024.06.04.0.2; Google Bazel For Clion 2024.06.04.0.2; Google Bazel For Intellij 2024.06.04.0.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-5899 or the next vulnerability affects your stack