CVE-2026-64806 is a vulnerability in JetBrains WebStorm affecting versions prior to 2026.2. It allows arbitrary code execution before the user grants project trust, leveraging the configured Node.js interpreter. This issue is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The vulnerability has a CVSS v3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating local attack vector with low complexity and no privileges or user interaction required, resulting in high confidentiality, integrity, and availability impacts. No official remediation or patch has been announced by JetBrains as of the publication date.

Successful exploitation allows an attacker with local access to execute arbitrary code via the Node.js interpreter before project trust is granted, potentially compromising confidentiality, integrity, and availability of the affected system. This could lead to full system compromise depending on the privileges of the WebStorm process.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening untrusted projects and consider restricting local access to WebStorm environments. Monitor JetBrains advisories for updates on patches or official mitigations.