Jetbrains Webstorm vulnerabilities
9 vulnerabilities
Known vulnerabilities in Jetbrains Webstorm, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-31897jetbrainswebstorm
EPSS score1.54%
In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects.CVE-2021-31898jetbrainswebstormEPSS score0.63%
In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.CVE-2021-45977jetbrainsclion+6EPSS score1.08%
JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, RubyMine 2021.3.1 RC, CLion 2021.3.1, WebStorm 2021.3.1 Preview, and WebStorm 2021.3.1 RC (used as Remote Development backend IDEs) bind to the 0.0.0.0 IP address. The fixed versions are: IntelliJ IDEA 2021.3.1, PyCharm Professional 2021.3.1, GoLand 2021.3.2, PhpStorm 2021.3.1 (213.6461.83), RubyMine 2021.3.1, CLion 2021.3.2, and WebStorm 2021.3.1.CVE-2024-52555jetbrainswebstormEPSS score0.11%
In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer scriptCVE-2024-37051jetbrainsaqua+12EPSS score4.88%
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7, 2024.1.3, 2024.2 EAP3; PyCharm 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.3, 2024.2 EAP2; Rider 2023.1.7, 2023.2.5, 2023.3.6, 2024.1.3; RubyMine 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP4; RustRover 2024.1.1; WebStorm 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.4CVE-2026-64807jetbrainswebstormEPSS score0.18%
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configurationCVE-2026-64804jetbrainswebstormEPSS score0.19%
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter toolingCVE-2026-64805jetbrainswebstormEPSS score0.19%
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager toolingCVE-2026-64806jetbrainswebstormEPSS score0.19%
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter