CVE-2026-123322 · Runtime
NO FIX YET · SEE WHAT TO DO
In JetBrains WebStorm before 2026.3 (and 2026.2.4), opening an untrusted project could execute code through the Angular CLI schematics loader. An attacker who gets a developer to open a malicious project may run code as that developer.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Developers who open projects they do not trust in WebStorm, especially Angular projects, can be exposed when the Angular CLI schematics loader runs. Teams that only open their own trusted repositories are at lower risk. unknown whether the sources specify the exact trust prompt behaviour.
Not affected if patched-version, trusted-projects-only
Who cares angular, developer-tools, jetbrains, webstorm
2026.3 or below 2026.2.42026.3 or later, or to 2026.2.4 or later on that branchIn JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.