CVE-2026-64806
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In JetBrains WebStorm before 2026.2, arbitrary code execution was possible before granting project trust via the configured Node.js interpreter.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code in the context of the IDE, potentially leading to compromise of the development system.
Recommendation
It is recommended to immediately update JetBrains WebStorm to version 2026.2 or later.
Other vulnerabilities in JetBrains WebStorm
See all- CVE-2026-64807High
In JetBrains WebStorm before version 2026.2, arbitrary code execution was possible via a project-supplied linter configuration.
- CVE-2026-64805High
In JetBrains WebStorm before 2026.2, arbitrary code execution was possible before granting project trust via project-local package-manager tooling.
- CVE-2026-64804High
In JetBrains WebStorm before 2026.2, arbitrary code execution was possible before granting project trust via project-local linter tooling.
Original NVD description (English source)
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter