Phpstorm
Monthly
Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run attacker-controlled code through the configured interpreter before the developer grants project trust, bypassing the IDE's trust-gate safeguard. Tagged as RCE by the reporting vendor (JetBrains), the flaw carries a CVSS 8.4 and requires a developer to open a crafted project locally. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run code through project tooling before the user grants project trust, bypassing the IDE's trust-boundary safeguard. Reported by JetBrains itself (cve@jetbrains.com) and tagged RCE, it lets an attacker who tricks a developer into opening a crafted repository execute code in the developer's context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the local high-impact (C:H/I:H/A:H) nature makes it relevant for developer-workstation threat models.
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains PhpStorm before 2020.3, source code could be added to debug logs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run attacker-controlled code through the configured interpreter before the developer grants project trust, bypassing the IDE's trust-gate safeguard. Tagged as RCE by the reporting vendor (JetBrains), the flaw carries a CVSS 8.4 and requires a developer to open a crafted project locally. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary code execution in JetBrains PhpStorm before 2026.2 allows a malicious project to run code through project tooling before the user grants project trust, bypassing the IDE's trust-boundary safeguard. Reported by JetBrains itself (cve@jetbrains.com) and tagged RCE, it lets an attacker who tricks a developer into opening a crafted repository execute code in the developer's context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the local high-impact (C:H/I:H/A:H) nature makes it relevant for developer-workstation threat models.
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains PhpStorm before 2020.3, source code could be added to debug logs. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.