AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

JetBrainsCVE-2026-64806

JetBrains WebStorm: code execution

JetBrains

CVE-2026-64806 · Published Jul 23, 2026 · updated Jul 28, 2026

High8.4
Fix: upgrade to 2026.2 or later
JetBrains advisory

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter

Affected versions

PackageAffectedFixed in
WebStorm
Product
< 2026.22026.2
Details and references
CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-829

More JetBrains advisories

All JetBrains
High 8.8Jul 23JetBrains TeamCity: code injectionCVE-2026-65906fixed in 2026.1.2 +1Critical 9.1Jul 23JetBrains TeamCity: code executionCVE-2026-65907fixed in 2026.1.2 +1High 8.6Jul 23JetBrains PyCharm: code executionCVE-2026-65908fixed in 2026.1.4 +1High 8.6Jul 23JetBrains IntelliJ IDEA: missing authorizationCVE-2026-64814fixed in 2026.2High 8.1Jul 23JetBrains IntelliJ IDEA: code injectionCVE-2026-64815fixed in 2026.2High 7.8Jul 23JetBrains WebStorm: code executionCVE-2026-64807fixed in 2026.2