Executive brief
JetBrains WebStorm, a popular development environment for JavaScript and web technologies, was vulnerable to a security flaw that allowed malicious code to run on a developer's machine. By including a specially crafted linter configuration file within a project, an attacker could gain full control over the user's system when the project is opened. This could lead to the theft of source code, credentials, or sensitive company data.
Technical details
A vulnerability classified as 'Inclusion of Functionality from Untrusted Control Sphere' (CWE-829) exists in JetBrains WebStorm versions prior to 2026.2. The issue stems from the IDE improperly handling linter configuration files provided within a project directory. An attacker can exploit this by tricking a user into opening a malicious project containing a crafted linter config, leading to arbitrary code execution with the privileges of the IDE user. The attack requires local access to the project files and user interaction (opening the project). The issue has been addressed in WebStorm version 2026.2.
Affected products
- JetBrains WebStorm before 2026.2
Timeline
- 2026-07-23: disclosed
- 2026-07-23: advisory