JetBrains WebStorm versions prior to 2026.2 contain a vulnerability (CVE-2026-64805) that permits arbitrary code execution before the user grants project trust. This occurs through project-local package-manager tooling, which can be exploited to execute code without user interaction or privileges. The vulnerability is categorized as CWE-829, indicating the inclusion of functionality from untrusted sources. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires local access but no privileges or user interaction, and results in high impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been published yet.

Successful exploitation of this vulnerability allows an attacker with local access to execute arbitrary code on the affected system without requiring user interaction or privileges. This can lead to full compromise of confidentiality, integrity, and availability of the system running WebStorm before version 2026.2. There are no reports of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening untrusted projects and avoid running WebStorm in environments where local attackers may have access. Monitor JetBrains advisories for updates on patches or mitigations.