Jetbrains Webstorm
9 CVEs affecting Jetbrains Webstorm. Latest disclosed: 2026-07-23. Critical: 3, High: 5.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-45977 | Critical | 9.8 | 2022-02-25 | JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 202… |
CVE-2021-31897 | Critical | 9.8 | 2021-05-11 | In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects. |
CVE-2024-37051 | Critical | 9.3 | 2024-06-10 | GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 202… |
CVE-2026-64806 | High | 8.4 | 2026-07-23 | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter |
CVE-2026-64805 | High | 8.4 | 2026-07-23 | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling |
CVE-2026-64804 | High | 8.4 | 2026-07-23 | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling |
CVE-2026-64807 | High | 7.8 | 2026-07-23 | In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration |
CVE-2021-31898 | High | 7.5 | 2021-05-11 | In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS. |
CVE-2024-52555 | Medium | 6.3 | 2024-11-15 | In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script |