High · 7.8 CVE-2026-123321 EUVD-2026-118085GHSA-9jwp-fgw3-v68x

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects

Published Nov 6, 2026 · Updated Nov 7, 2026 · Assigned by JetBrains

Vendor: JetBrains Product: WebStorm

Description

In JetBrains WebStorm before 2026.3,
2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects

Affected products

Vendor	Product	Affected	Fixed
JetBrains	WebStorm	< 2026.3, 2026.2.3	2026.3, 2026.2.3

Advisories 1

WID-SEC-2026-4380 JetBrains WebStorm: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Nov 5, 2026

References

https://www.jetbrains.com/privacy-security/issues-fixed/