CVE-2026-123322: Medium severity vulnerability

Published Nov 6, 2026

Updated

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader

Event History

Nov 6, 2026

CVE Published

via MITRE·10:28 AM

Data Sourced

via MITRE·10:28 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

WebStorm users who open or work with untrusted projects are the relevant exposure group. The attack vector is local and exploitation requires user interaction.

What conditions are required for exploitation?

An attacker would need to rely on the Angular CLI schematics loader in an untrusted project and induce user interaction. The CVSS vector also indicates high attack complexity and no privileges required.

Which WebStorm versions should be remediated?

The issue affects WebStorm versions before 2026.3. Version 2026.2.4 is identified in the vulnerability information as a fixed release.

CVE-2026-123322: Medium severity vulnerability

Event History

Frequently Asked Questions

Who is exposed to this issue?

What conditions are required for exploitation?

Which WebStorm versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What conditions are required for exploitation?

Which WebStorm versions should be remediated?