CVE-2026-64804 in WebStorm
Summary
by MITRE • 07/23/2026
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/26/2026
JetBrains WebStorm versions prior to 2026.2 contained a critical security vulnerability that allowed for arbitrary code execution through project-local linter tooling without requiring explicit project trust authorization. This flaw exploited the automatic execution of linting processes that occurred during project initialization or file operations, enabling malicious actors to inject and execute arbitrary code within the development environment. The vulnerability specifically targeted the handling of project-local configuration files and tooling integrations that were automatically processed by WebStorm's linter subsystem.
The technical implementation of this vulnerability stemmed from insufficient input validation and sandboxing mechanisms within WebStorm's project-local tooling execution framework. When developers opened projects containing maliciously crafted linter configuration files or dependencies, the IDE would automatically invoke local linting tools without proper security boundaries. This behavior violated fundamental security principles by executing untrusted code in the context of the user's development environment, effectively bypassing traditional trust models that typically require explicit user consent before executing potentially dangerous operations.
The operational impact of this vulnerability was significant as it allowed remote attackers to compromise developer workstations through seemingly benign project files or dependencies. Attackers could craft malicious package.json entries, eslint configuration files, or other linter-related artifacts that would execute arbitrary commands when WebStorm processed them during normal development workflows. This created a persistent threat vector where developers inadvertently executed malicious code simply by opening vulnerable projects, making the attack surface particularly broad and difficult to control.
Organizations and individual developers using affected WebStorm versions faced substantial risk of credential theft, data exfiltration, and system compromise through this vulnerability. The attack could be initiated through various vectors including open source project repositories, dependency downloads, or shared development environments where malicious code might be introduced. This vulnerability aligns with CWE-94, which describes the improper execution of generated code, and specifically relates to the ATT&CK technique T1059.007 for command and scripting interpreter JavaScript, as it enabled execution of arbitrary commands through JavaScript-based linter tooling.
The recommended mitigation strategy involved upgrading to JetBrains WebStorm 2026.2 or later versions where proper sandboxing and trust boundary enforcement had been implemented for project-local tooling execution. Additionally, organizations should implement strict dependency verification processes, regular security scanning of development environments, and educate developers about the risks of opening untrusted projects. Security configurations should enforce more restrictive execution policies for local tooling integrations, ensuring that potentially dangerous operations require explicit user confirmation before execution. The fix implemented by JetBrains addressed the core issue by introducing proper isolation mechanisms between project-local linter processes and the IDE's main execution environment, preventing automatic code execution without explicit trust authorization.