JetBrains WebStorm CVE-2026-64805

Exploitation requires the victim to open an attacker-controlled project in WebStorm before 2026.2, where that project supplies malicious project-local package-manager tooling/configuration (e.g., package.json scripts, a lockfile, or a project-scoped package-manager path). The key limiting factors are: the attacker cannot trigger this remotely (AV:L) and must get the developer to obtain and open the project; exploitation only works on WebStorm versions prior to 2026.2; and it specifically abuses the window before project trust is granted, so it is the automatic package-manager resolution on project open - not an explicit run action - that is the trigger. It does not require the victim to hold any elevated privileges (PR:N).

The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) reflects a local vector with no privileges and full compromise of confidentiality, integrity, and availability. AV:L means an attacker cannot reach the IDE over the network directly; delivery is social/supply-chain - the victim must obtain and open a malicious project. Notably the vendor rates UI:N, but realistically some user action (opening/cloning the project) is involved, so the honest limiting factor is that a developer must open attacker-controlled project files. No EPSS score, KEV listing, or POC was supplied, so exploitation probability cannot be quantified from the data, and the absence of KEV means no confirmed active exploitation. Real-world priority is elevated for teams that routinely open third-party or untrusted repositories (open-source triage, code review, consultancy) and lower for developers who only open first-party code. This is a genuine trust-boundary bypass rather than a purely theoretical high-CVSS issue, but its impact is gated by the delivery step.

An attacker publishes a repository (e.g., a tempting open-source library, coding challenge, or bug reproduction) containing crafted project-local package-manager configuration. A developer clones and opens it in a vulnerable WebStorm; the IDE invokes the attacker-controlled tooling and executes code as the developer before any trust prompt is shown. No public POC was identified, and the local attack vector means the attacker relies on the victim opening the project.