Arbitrary Code Execution in JetBrains WebStorm Affected by Linter Configuration
CVE-2026-64807

7.8HIGH

Key Information:

Vendor

Jetbrains
Status
Webstorm
Vendor
CVE Published:
23 July 2026

What is CVE-2026-64807?

A vulnerability in JetBrains WebStorm prior to version 2026.2 allows arbitrary code execution through a maliciously crafted linter configuration supplied within a project. This flaw can enable an attacker to execute code with the privileges of the user running the IDE, thereby posing a significant security risk. Users of affected versions are urged to review their linter configurations and upgrade to the latest version to mitigate potential threats.

Affected Version(s)

WebStorm 0 < 2026.2

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.