CVE-2026-64805

Analyzed Analyzed - Analysis Complete

Arbitrary Code Execution in JetBrains WebStorm

Publication date: 2026-07-23

Last updated on: 2026-07-28

Assigner: JetBrains s.r.o.

Description

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-23

Last Modified

2026-07-28

Generated

2026-08-12

AI Q&A

2026-07-23

EPSS Evaluated

2026-08-11

NVD

CVE-2026-64805

EUVD

EUVD-2026-48230

Affected Vendors & Products

Vendor	Product	Version / Range
jetbrains	webstorm	to 2026.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability in JetBrains WebStorm before version 2026.2 allows arbitrary code execution before a user grants trust to a project. It specifically involves project-local package-manager tooling, meaning malicious code could run automatically when opening a project.

Detection Guidance

This vulnerability is specific to JetBrains WebStorm versions before 2026.2 and involves arbitrary code execution before project trust is granted. Detection should focus on identifying outdated WebStorm installations. Check the installed version of WebStorm using the Help > About menu or via command line if installed in a standard location. Compare the version against 2026.2 or later.

Impact Analysis

An attacker could exploit this to execute malicious code on your system without your knowledge. This could lead to data theft, system compromise, or further attacks. The high CVSS score (8.4) indicates severe impact.

Compliance Impact

The vulnerability allows arbitrary code execution before project trust is granted via project-local package-manager tooling. This could potentially lead to unauthorized access or data breaches, which may impact compliance with standards like GDPR (data protection) or HIPAA (health information). However, the provided CVE details do not specify direct compliance implications.

Mitigation Strategies

Update JetBrains WebStorm to version 2026.2 or later to address the arbitrary code execution vulnerability.

Hi! I’m here to help you understand CVE-2026-64805. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70