JetBrains WebStorm CVE-2026-64804

Exploitation requires a victim developer to open or import an attacker-crafted project in WebStorm that ships a malicious project-local linter (e.g., ESLint/TSLint) binary and/or configuration; the code runs during the pre-trust automatic tooling invocation, before the user clicks 'Trust Project'. Limiting factors: the attacker must deliver the hostile repository and induce the target to open it locally (AV:L), the affected build must be earlier than WebStorm 2026.2, and the IDE's linter integration must engage the project-local tooling. The NVD vector's UI:N understates the practical need for the user to open the project; the exploit does not work over the network without that local action.

The NVD CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) rates this High with full CIA impact but a LOCAL attack vector and, notably, UI:N - which conflicts with the description's premise that a victim must open/import a malicious project. That UI:N is likely optimistic: realistically some user interaction (opening the project) is required, which lowers real-world likelihood versus a purely passive local flaw - verify with vendor. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Net: a genuinely high-impact code-execution issue for developer workstations, but exploitation depends on social engineering a developer into opening a hostile repository, making it a targeted supply-chain/developer-trust risk rather than a mass-exploitable network threat.

An attacker publishes a repository (e.g., an npm package fork, coding challenge, or job-application starter kit) containing a malicious project-local linter binary and configuration. When a developer clones and opens it in a vulnerable WebStorm, the IDE invokes the linter tooling before showing/honoring the trust prompt, executing the attacker's code with the developer's privileges. No public POC is currently identified, and the local attack vector means the attacker relies on luring the victim into opening the project.