CVE-2026-64804 is a vulnerability in JetBrains WebStorm that enables arbitrary code execution through project-local linter tooling before the user grants project trust. This occurs in versions prior to 2026.2, although exact affected versions are not explicitly stated. The vulnerability is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The CVSS 3.1 base score is 8.4, indicating high impact with local attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality, integrity, and availability impacts. No official remediation level or patch information is currently available from the vendor.

Successful exploitation allows an attacker to execute arbitrary code locally on the system running WebStorm before the project is trusted, potentially compromising confidentiality, integrity, and availability of the affected system. This could lead to full system compromise depending on the privileges of the user running the IDE.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening untrusted projects and avoid enabling project-local linters or other tooling before granting project trust.