CVE-2026-64807 is a high-severity vulnerability in JetBrains WebStorm affecting versions prior to 2026.2. It involves arbitrary code execution triggered by a malicious project-supplied linter configuration. The vulnerability is categorized under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). Exploitation requires local access and user interaction, and successful exploitation can result in complete compromise of the affected system's confidentiality, integrity, and availability. As of the published date, no official fix or remediation level has been provided by JetBrains.

An attacker with local access and the ability to influence the linter configuration in a WebStorm project can execute arbitrary code on the victim's system. This can lead to full compromise of the system's confidentiality, integrity, and availability. The vulnerability poses a significant risk to users running affected versions of WebStorm.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening projects from untrusted sources and avoid using untrusted linter configurations.