JetBrains WebStorm versions prior to 2026.2 contain a vulnerability (CWE-829) that permits arbitrary code execution through project-local package-manager tooling before the user grants project trust. This means that malicious code could be executed without user authorization in the context of the IDE, potentially compromising the system. The vulnerability has a CVSS 3.1 score of 8.4, indicating a high severity with local attack vector, low attack complexity, no privileges required, and no user interaction needed. No official fix or patch has been published as of the data provided.

Successful exploitation of this vulnerability could lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data, and disruption of system availability. Since the attack requires local access but no privileges or user interaction, it poses a significant risk to users who open untrusted projects in WebStorm before granting project trust.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening untrusted projects in WebStorm and exercise caution with project-local package-manager tooling. Monitor JetBrains advisories for updates on patches or workarounds.