CVE-2026-64807 is a vulnerability in JetBrains WebStorm that permits arbitrary code execution through a specially crafted project-supplied linter configuration. This affects versions prior to 2026.2. The vulnerability has a CVSS 3.1 score of 7.8, indicating high impact with local attack vector, low attack complexity, no privileges required, but user interaction is necessary. The vulnerability impacts confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation allows an attacker to execute arbitrary code on the system where WebStorm is running, potentially compromising confidentiality, integrity, and availability of the affected environment. The attack requires local access and user interaction, limiting remote exploitation but still posing a significant risk to users opening malicious project configurations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should avoid opening untrusted project configurations that include linter settings. Monitor official JetBrains channels for updates and apply patches promptly once available.