EUVD-2026-48229
GHSA-x88m-wx27-x7m2
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local delivery via a malicious project the developer must open (AV:L, UI:R); no auth needed (PR:N); pre-trust code execution yields full local C/I/A impact.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling
AnalysisAI
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code via project-local linter tooling before the user grants project trust, bypassing the IDE's Trust Projects safeguard. The flaw (CWE-829) affects developers who open or import a crafted repository; no public exploit or active exploitation has been identified, and no EPSS/KEV signal is present in the provided data. Fixed in WebStorm 2026.2.
Technical ContextAI
WebStorm is JetBrains' commercial IDE for JavaScript/TypeScript development, built on the IntelliJ platform. Modern JetBrains IDEs auto-detect and invoke project-local tooling - here linters such as ESLint/TSLint resolved from a project's node_modules and driven by project-checked-in configuration. The Trust Projects security model is designed to defer execution of such automation until the user explicitly trusts a project. This vulnerability maps to CWE-829 (Inclusion of Functionality from an Untrusted Control Sphere): the IDE resolves and executes attacker-controlled linter binaries/config from the untrusted project directory before the trust gate is enforced, so functionality from an untrusted control sphere runs with the developer's privileges.
RemediationAI
Vendor-released patch: upgrade WebStorm to 2026.2 or later, which enforces the trust gate before project-local linter tooling is executed; see https://www.jetbrains.com/privacy-security/issues-fixed/. Until upgraded, do not open or import untrusted or unfamiliar repositories in WebStorm, and treat cloning-then-opening a third-party project as a privileged action. As compensating controls, disable automatic linter/ESLint integration (Settings → Languages & Frameworks → JavaScript → Code Quality Tools) so project-local tooling is not auto-run - trade-off: developers lose inline lint feedback until re-enabled - and open suspicious projects only inside a disposable VM or container so any pre-trust code execution is contained. Avoid relying on the Trust Projects prompt alone, since that is the control this vulnerability bypasses.
In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects. Rated
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code through the configur
Arbitrary code execution in JetBrains WebStorm before 2026.2 lets a malicious project run code on a developer's machine
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run attacker-controlled code
In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS. Rated high severity (CVSS 7.5), this vuln
Share
External POC / Exploit Code
Leaving vuln.today