CVE-2026-123322
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects...
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
- Record
CVE-2026-123322- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-829
- Updated
- 2026-11-06
EUVDEUVD-2026-118086
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
- Record
EUVD-2026-118086- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-54w2-mh7h-c6mv
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects...
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
- Record
GHSA-54w2-mh7h-c6mv- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-829
- Updated
- 2026-11-06
NVD
In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
- Record
CVE-2026-123322- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-829
- Updated
- 2026-11-07
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| published | EUVD | |
| published | EUVD, NVD | |
| aliases, references, title | GitHub Advisories | |
| cwes, severity | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-123322 is a medium vulnerability (CVSS 6.3) in Jetbrains Webstorm, published November 6, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.10%, the 0th percentile. No source names a fixed version.