What is the CVSS score of CVE-2026-64806?

CVE-2026-64806 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of JetBrains WebStorm are affected by CVE-2026-64806?

JetBrains WebStorm versions prior to 2026.2 contain an arbitrary code execution vulnerability that bypasses the IDE's project trust mechanism; no public exploit identified at time of analysis, but…. A patch is available.

How to fix or mitigate CVE-2026-64806?

Within 24 hours: Inventory all WebStorm installations organization-wide and identify instances running versions before 2026.2; alert affected development teams of the vulnerability and implement temporary restrictions on opening external or untrusted projects. Within 7 days: Deploy compensating controls including mandatory security review and static analysis of all externally-sourced projects before opening in WebStorm, and disable Node.js interpreter integration if not actively required for development workflows. Within 30 days: Plan and execute coordinated upgrade to WebStorm version 2026.2 or later across all development workstations, prioritizing teams handling sensitive code or external contributions.

JetBrains WebStorm CVE-2026-64806

EUVD-2026-48231 HIGH

Inclusion of Functionality from Untrusted Control Sphere (CWE-829)

2026-07-23 cve@jetbrains.com

GHSA-cp73-r8rc-6v5m

RCE Node.js Webstorm JetBrains

8.4

CVSS 3.1 · Vendor: jetbrains

Severity by source

Vendor (jetbrains) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local because the malicious project must be opened on the host (AV:L); PR:N as no prior privileges are needed, but UI:R since the victim must open the attacker's project, with full C/I/A impact as user.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (jetbrains).

CVSS VectorVendor: jetbrains

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 23, 2026 - 14:04 EUVD

Analysis Generated

Jul 23, 2026 - 12:56 vuln.today

CVE Published

Jul 23, 2026 - 12:18 cve.org

HIGH 8.4

DescriptionCVE.org

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter

Articles & Coverage 2

News 3 New Node.js Vulnerabilities - 3 High Severity, 1 With POC Jul 24, 2026 News 3 New Node.js Vulnerabilities - 3 High Severity Jul 23, 2026

AnalysisAI

Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code through the configured Node.js interpreter before the developer grants the project the required trust. Any developer who opens (or clones and opens) an attacker-supplied project is affected, since the IDE's trust prompt - designed to gate execution - is bypassed. No public exploit has been identified and it is not in CISA KEV, but the RCE and Node.js tags plus a local, no-privilege CVSS 8.4 vector make this a meaningful supply-chain/developer-workstation risk.

Technical ContextAI

WebStorm is JetBrains' commercial IDE for JavaScript/TypeScript and Node.js development, part of the IntelliJ platform. The IDE ships a 'project trust' security model that is supposed to withhold execution of project-supplied code (build scripts, interpreters, run configurations) until the user explicitly marks the project as trusted. This flaw is classified as CWE-829 (Inclusion of Functionality from an Untrusted Control Sphere): the configured Node.js interpreter - a path that can be defined inside project settings such as .idea configuration or workspace metadata - is invoked before the trust gate is enforced, so functionality from an untrusted project is loaded into the trusted IDE context. In practice this means a project can point the 'Node.js interpreter' at an attacker-controlled binary or script that executes automatically during project loading/indexing rather than after consent.

RemediationAI

Vendor-released patch: WebStorm 2026.2 - upgrade to 2026.2 or later, which is the primary and complete fix (see https://www.jetbrains.com/privacy-security/issues-fixed/). Until upgraded, the most effective compensating control is to never open untrusted or third-party projects in a vulnerable WebStorm, and where possible open unknown repositories only in a disposable VM or container so any interpreter execution is contained (trade-off: added workflow friction). Inspect a cloned project's .idea/workspace configuration and any project-scoped Node.js interpreter setting before opening, and prefer a globally-pinned, known-good Node.js interpreter rather than project-supplied paths (trade-off: manual review, and the flaw fires before the trust prompt so this is imperfect). Restrict developer workstations from cloning arbitrary external repositories where policy allows.