Webstorm
Monthly
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run attacker-controlled code on a developer's machine by supplying a crafted linter configuration that the IDE trusts and executes when the project is opened. Reported by JetBrains itself (cve@jetbrains.com) and tagged RCE, the flaw carries CVSS 7.8 (high) with a local vector and required user interaction. There is no public exploit identified at time of analysis and no CISA KEV listing, indicating no confirmed active exploitation to date.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code through the configured Node.js interpreter before the developer grants the project the required trust. Any developer who opens (or clones and opens) an attacker-supplied project is affected, since the IDE's trust prompt - designed to gate execution - is bypassed. No public exploit has been identified and it is not in CISA KEV, but the RCE and Node.js tags plus a local, no-privilege CVSS 8.4 vector make this a meaningful supply-chain/developer-workstation risk.
Arbitrary code execution in JetBrains WebStorm before 2026.2 lets a malicious project run code on a developer's machine before the IDE's project-trust prompt is ever answered, by abusing project-local package-manager tooling that the IDE invokes automatically. Because execution happens prior to the trust gate, the safety boundary meant to protect users who merely open an untrusted repository is bypassed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the RCE tag and full C/I/A impact make this a meaningful developer-workstation risk.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code via project-local linter tooling before the user grants project trust, bypassing the IDE's Trust Projects safeguard. The flaw (CWE-829) affects developers who open or import a crafted repository; no public exploit or active exploitation has been identified, and no EPSS/KEV signal is present in the provided data. Fixed in WebStorm 2026.2.
In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run attacker-controlled code on a developer's machine by supplying a crafted linter configuration that the IDE trusts and executes when the project is opened. Reported by JetBrains itself (cve@jetbrains.com) and tagged RCE, the flaw carries CVSS 7.8 (high) with a local vector and required user interaction. There is no public exploit identified at time of analysis and no CISA KEV listing, indicating no confirmed active exploitation to date.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code through the configured Node.js interpreter before the developer grants the project the required trust. Any developer who opens (or clones and opens) an attacker-supplied project is affected, since the IDE's trust prompt - designed to gate execution - is bypassed. No public exploit has been identified and it is not in CISA KEV, but the RCE and Node.js tags plus a local, no-privilege CVSS 8.4 vector make this a meaningful supply-chain/developer-workstation risk.
Arbitrary code execution in JetBrains WebStorm before 2026.2 lets a malicious project run code on a developer's machine before the IDE's project-trust prompt is ever answered, by abusing project-local package-manager tooling that the IDE invokes automatically. Because execution happens prior to the trust gate, the safety boundary meant to protect users who merely open an untrusted repository is bypassed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the RCE tag and full C/I/A impact make this a meaningful developer-workstation risk.
Arbitrary code execution in JetBrains WebStorm before 2026.2 allows a malicious project to run code via project-local linter tooling before the user grants project trust, bypassing the IDE's Trust Projects safeguard. The flaw (CWE-829) affects developers who open or import a crafted repository; no public exploit or active exploitation has been identified, and no EPSS/KEV signal is present in the provided data. Fixed in WebStorm 2026.2.
In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.