CVE-2026-123321: High severity vulnerability

Published Nov 6, 2026

Updated

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects

Event History

Nov 6, 2026

CVE Published

via MITRE·10:28 AM

Data Sourced

via MITRE·10:28 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of JetBrains WebStorm versions before 2026.2.3 who open or load untrusted projects that contain Grunt or Gulp task configurations are exposed.

What does exploitation require?

An attacker needs to convince a user to interact with an untrusted project. The CVSS vector indicates local attack access, no privileges required, and user interaction required.

What should teams do to remediate the issue?

Update WebStorm to version 2026.2.3 or later. Until updating is possible, do not open or load Grunt or Gulp tasks from untrusted projects.

CVE-2026-123321: High severity vulnerability

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does exploitation require?

What should teams do to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does exploitation require?

What should teams do to remediate the issue?