High · 8.4 CVE-2026-64804 EUVD-2026-48229GHSA-x88m-wx27-x7m2

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling

Published Jul 23, 2026 · Updated Jul 24, 2026 · Assigned by JetBrains

Vendor: JetBrains Product: WebStorm

Description

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling

Affected products

Vendor	Product	Affected	Fixed
JetBrains	WebStorm	< 2026.2	2026.2

Advisories 1

WID-SEC-2026-2507 JetBrains WebStorm: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Jul 23, 2026

References

https://www.jetbrains.com/privacy-security/issues-fixed/