CVE-2026-64807
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In JetBrains WebStorm before version 2026.2, arbitrary code execution was possible via a project-supplied linter configuration.
Risk Assessment
An attacker can supply a malicious project that, when opened in WebStorm, executes arbitrary code via the linter configuration, potentially leading to system compromise or data theft.
Recommendation
Upgrade WebStorm to version 2026.2 or later, which includes a fix.
Other vulnerabilities in JetBrains WebStorm
See all- CVE-2026-64806High
In JetBrains WebStorm before 2026.2, arbitrary code execution was possible before granting project trust via the configured Node.js interpreter.
- CVE-2026-64805High
In JetBrains WebStorm before 2026.2, arbitrary code execution was possible before granting project trust via project-local package-manager tooling.
- CVE-2026-64804High
In JetBrains WebStorm before 2026.2, arbitrary code execution was possible before granting project trust via project-local linter tooling.
Original NVD description (English source)
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration