Arbitrary Code Execution in JetBrains WebStorm Affected by Node.js Interpreter Configuration
CVE-2026-64806

8.4HIGH

Key Information:

Vendor

Jetbrains
Status
Webstorm
Vendor
CVE Published:
23 July 2026

What is CVE-2026-64806?

In JetBrains WebStorm prior to version 2026.2, a vulnerability allows for arbitrary code execution due to improper handling of project trust when using the configured Node.js interpreter. This flaw may allow attackers to execute malicious code, compromising the integrity of the development environment and potentially leading to further security issues.

Affected Version(s)

WebStorm 0 < 2026.2

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.