{"id":"CVE-2026-123321","kind":"vulnerability","aliases":["CVE-2026-123321"],"related":[],"title":"JetBrains WebStorm: opening untrusted project runs code via Grunt and Gulp","description":"In JetBrains WebStorm before 2026.3, \n2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects","summary":"In JetBrains WebStorm before 2026.3 and 2026.2.3, loading Grunt and Gulp tasks could execute code from an untrusted project. An attacker who gets a developer to open a crafted project can run code on the developer's machine.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-tools","grunt","gulp","jetbrains","package","webstorm"],"not_affected_if":["trusted-projects-only","webstorm-updated"],"how_to_check":"- Check the installed WebStorm version in Help > About.\n- Compare it against `2026.3` and `2026.2.3`; older builds are affected.","fix":"- JetBrains WebStorm: move to `2026.3` or `2026.2.3`.","status":"open","published_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:27+00:00","triaged_at":"2026-11-06T11:41:58+00:00","updated_at":"2026-11-06T11:41:58+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T11:41:58Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains WebStorm: move to `2026.3` or `2026.2.3`.","reach":"local","title":"JetBrains WebStorm: opening untrusted project runs code via Grunt and Gulp","impact":"high","summary":"In JetBrains WebStorm before 2026.3 and 2026.2.3, loading Grunt and Gulp tasks could execute code from an untrusted project. An attacker who gets a developer to open a crafted project can run code on the developer's machine.","audience":"developers","category":"package","nicknames":[],"who_cares":["webstorm","jetbrains","grunt","gulp","developer-tools"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"code runs on the developer's machine when opening a project","analyst_note":"Confirm the exact trust-dialog behaviour and the fixed build per branch from the JetBrains release notes; the sources give only the NVD summary.","how_to_check":"- Check the installed WebStorm version in Help > About.\n- Compare it against `2026.3` and `2026.2.3`; older builds are affected.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-projects-only","webstorm-updated"],"who_is_affected":"Developers who open projects from sources they do not fully trust in WebStorm builds before 2026.3 or 2026.2.3. Teams that only open their own trusted repositories are at lower risk. The sources do not say whether trust prompts change exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000696,"input_tokens":4187,"output_tokens":555,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123321':14A,17A '-2026':13A,16A '2026.2.3':32B,69C '2026.3':30B,68C 'attack':46B 'code':7A,40B,58B,70C 'could':38B 'craft':54B 'cve':12A,15A 'develop':19B,50B,61B 'developer-tool':18B 'execut':39B,71C 'get':48B 'grunt':9A,21B,34B,73C 'gulp':11A,22B,36B,75C 'jetbrain':1A,23B,27B,65C 'load':33B,77C 'machin':63B 'open':3A,52B 'packag':24B 'possibl':79C 'project':5A,44B,55B,82C 'run':6A,57B 'task':37B,76C 'tool':20B 'untrust':4A,43B,81C 'via':8A,72C 'webstorm':2A,25B,28B,66C","nicknames":[],"mitigations":[],"who_affected":"Developers who open projects from sources they do not fully trust in WebStorm builds before 2026.3 or 2026.2.3. Teams that only open their own trusted repositories are at lower risk. The sources do not say whether trust prompts change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developertools","grunt","gulp","high","jetbrains","package","webstorm"],"campaign_type":null,"search_a":"'-123321':14A,17A '-2026':13A,16A 'code':7A 'cve':12A,15A 'grunt':9A 'gulp':11A 'jetbrain':1A 'open':3A 'project':5A 'run':6A 'untrust':4A 'via':8A 'webstorm':2A","search_b":"'2026.2.3':32B '2026.3':30B 'attack':46B 'code':40B,58B 'could':38B 'craft':54B 'develop':19B,50B,61B 'developer-tool':18B 'execut':39B 'get':48B 'grunt':21B,34B 'gulp':22B,36B 'jetbrain':23B,27B 'load':33B 'machin':63B 'open':52B 'packag':24B 'project':44B,55B 'run':57B 'task':37B 'tool':20B 'untrust':43B 'webstorm':25B,28B","search_c":"'2026.2.3':69C '2026.3':68C 'code':70C 'execut':71C 'grunt':73C 'gulp':75C 'jetbrain':65C 'load':77C 'possibl':79C 'project':82C 'task':76C 'untrust':81C 'via':72C 'webstorm':66C","first_public_at":"2026-11-06T11:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123321","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123321","severity":null,"published_at":"2026-11-06T11:17:11+00:00","modified_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:27+00:00","fetched_at":"2026-11-06T11:41:27+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}