EUVD-2026-48234
GHSA-3x85-78v7-w543
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local because the victim must open a malicious project (AV:L), and opening it is genuine user interaction (UI:R); no attacker privileges needed and code runs as the developer with full C/I/A impact.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter
AnalysisAI
Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run attacker-controlled code through the configured interpreter before the developer grants project trust, bypassing the IDE's trust-gate safeguard. Tagged as RCE by the reporting vendor (JetBrains), the flaw carries a CVSS 8.4 and requires a developer to open a crafted project locally. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
PhpStorm, like other JetBrains IDEs, supports a 'Trusted Projects' security model in which potentially dangerous automated actions (build steps, run configurations, interpreter/tooling invocation) are supposed to be deferred until the user explicitly grants trust to a newly opened project. This issue maps to CWE-829 (Inclusion of Functionality from an Untrusted Control Sphere): the project-supplied interpreter configuration (e.g., a PHP interpreter path or wrapper referenced by the project's .idea settings) is consulted and executed during the pre-trust project-loading phase, so functionality defined in the untrusted project's control sphere runs inside the developer's IDE process. Because the interpreter is invoked to inspect or index the project, an attacker who controls the project files controls what binary/command runs. No CPE strings were supplied in the intelligence, so exact edition/build enumeration relies on the vendor version boundary 'before 2026.2'.
RemediationAI
Vendor-released patch: PhpStorm 2026.2 - upgrade to 2026.2 or later, which is the primary and complete fix; verify details via the JetBrains security bulletin at https://www.jetbrains.com/privacy-security/issues-fixed/. Until upgrading, the effective compensating control is operational: do not open untrusted or third-party projects/repositories in a vulnerable PhpStorm, and only open code from sources you control, since the code executes before the trust prompt and the trust gate cannot be relied upon. Where feasible, inspect an unfamiliar project's interpreter configuration (.idea run/interpreter settings) in a plain text editor before opening it in the IDE, and consider opening suspect repositories inside a disposable VM or container to contain any pre-trust execution; the trade-off is added workflow friction and slower onboarding of external code.
Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run code through project tool
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
In JetBrains PhpStorm before 2020.3, source code could be added to debug logs. Rated medium severity (CVSS 5.3), this vu
Share
External POC / Exploit Code
Leaving vuln.today