EUVD-2026-48232
GHSA-r7gx-4q54-2wrv
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (jetbrains) · only source for this CVE.
CVSS VectorVendor: jetbrains
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration
AnalysisAI
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run attacker-controlled code on a developer's machine by supplying a crafted linter configuration that the IDE trusts and executes when the project is opened. Reported by JetBrains itself (cve@jetbrains.com) and tagged RCE, the flaw carries CVSS 7.8 (high) with a local vector and required user interaction. There is no public exploit identified at time of analysis and no CISA KEV listing, indicating no confirmed active exploitation to date.
In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects. Rated
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code through the configur
Arbitrary code execution in JetBrains WebStorm before 2026.2 lets a malicious project run code on a developer's machine
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code via project-local li
In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS. Rated high severity (CVSS 7.5), this vuln
Share
External POC / Exploit Code
Leaving vuln.today