Executive brief
JetBrains WebStorm, a popular development environment for JavaScript and web technologies, was vulnerable to a security flaw that allowed malicious code to run automatically when opening a project. This could occur even before the user explicitly granted 'trust' to the project, potentially allowing an attacker to compromise a developer's workstation simply by having them open a malicious folder. This poses a significant risk to intellectual property and local system security.
Technical details
A vulnerability in JetBrains WebStorm prior to version 2026.2 allowed for arbitrary code execution through the improper handling of project-local package-manager tooling. The flaw is categorized as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), where the IDE would execute local tooling before the user had confirmed the project was trusted. An attacker could exploit this by placing malicious scripts or binaries within a project's local environment that the IDE automatically invokes upon opening. This local attack vector requires no special privileges and can lead to full system compromise. The issue is resolved in WebStorm version 2026.2.
Affected products
- JetBrains WebStorm before 2026.2
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory