PatchSiren cyber security CVE debrief
CVE-2026-64807 JetBrains CVE debrief
CVE-2026-64807 is a HIGH-severity vulnerability in JetBrains WebStorm before version 2026.2, allowing arbitrary code execution via a project-supplied linter configuration. The vulnerability has a CVSS score of 7.8 and is classified under CWE-829. Users of affected versions should review and update their installations to prevent potential code execution. This vulnerability was published on 2026-07-23T12:18:36.217Z and has not been modified since then.
- Vendor
- JetBrains
- Product
- WebStorm
- CVSS
- HIGH 7.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-23
- Original CVE updated
- 2026-07-28
- Advisory published
- 2026-07-23
- Advisory updated
- 2026-07-28
Who should care
Users of JetBrains WebStorm before version 2026.2, administrators, and security teams should be aware of this vulnerability and take steps to update or mitigate the risk. This includes reviewing project-supplied linter configurations and implementing additional security measures to monitor and restrict code execution. Operators and platform administrators should prioritize updates and vulnerability management for affected deployments.
Technical summary
CVE-2026-64807 is a HIGH-severity vulnerability in JetBrains WebStorm before version 2026.2, allowing arbitrary code execution via a project-supplied linter configuration. The vulnerability has a CVSS score of 7.8. Affected users should update to version 2026.2.1 or later to address the vulnerability.
Defensive priority
Administrators should prioritize updating JetBrains WebStorm to version 2026.2.1 or later to address the arbitrary code execution vulnerability.
Recommended defensive actions
- Update JetBrains WebStorm to version 2026.2.1 or later
- Review project-supplied linter configurations for potential security risks
- Implement additional security measures to monitor and restrict code execution
Evidence notes
The CVE record indicates that JetBrains WebStorm before version 2026.2 was vulnerable to arbitrary code execution via a project-supplied linter configuration. The NVD entry is currently Analyzed. Evidence is limited to CVE and NVD details. Defenders should verify WebStorm versions and review project configurations for potential security risks.
Official resources
-
CVE-2026-64807 CVE record
CVE.org
-
CVE-2026-64807 NVD detail
NVD
-
Source item URL
nvd_modified
-
Mitigation or vendor reference
[email protected] - Vendor Advisory
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-23T12:18:36.217Z and has not been modified since then.