{"id":"CVE-2026-123322","kind":"vulnerability","aliases":["CVE-2026-123322"],"related":[],"title":"WebStorm: opening an untrusted project can run code via Angular CLI","description":"In JetBrains WebStorm before 2026.3, \n2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader","summary":"In JetBrains WebStorm before 2026.3 (and 2026.2.4), opening an untrusted project could execute code through the Angular CLI schematics loader. An attacker who gets a developer to open a malicious project may run code as that developer.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["angular","developer-tools","jetbrains","runtime","webstorm"],"not_affected_if":["patched-version","trusted-projects-only"],"how_to_check":"- Open WebStorm and check Help > About for the build version\n- Confirm whether the version is below `2026.3` or below `2026.2.4`","fix":"- Move WebStorm to `2026.3` or later, or to `2026.2.4` or later on that branch","status":"open","published_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:27+00:00","triaged_at":"2026-11-06T11:42:20+00:00","updated_at":"2026-11-06T11:42:20+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-06T11:42:20Z","model":"claude-haiku-5-5","output":{"fix":"- Move WebStorm to `2026.3` or later, or to `2026.2.4` or later on that branch","reach":"local","title":"WebStorm: opening an untrusted project can run code via Angular CLI","impact":"high","summary":"In JetBrains WebStorm before 2026.3 (and 2026.2.4), opening an untrusted project could execute code through the Angular CLI schematics loader. An attacker who gets a developer to open a malicious project may run code as that developer.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["webstorm","angular","jetbrains","developer-tools"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"code runs as the developer when an untrusted project opens","analyst_note":"","how_to_check":"- Open WebStorm and check Help > About for the build version\n- Confirm whether the version is below `2026.3` or below `2026.2.4`","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-projects-only","patched-version"],"who_is_affected":"Developers who open projects they do not trust in WebStorm, especially Angular projects, can be exposed when the Angular CLI schematics loader runs. Teams that only open their own trusted repositories are at lower risk. unknown whether the sources specify the exact trust prompt behaviour.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":4189,"output_tokens":507,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123322':14A,17A '-2026':13A,16A '2026.2.4':31B,67C '2026.3':29B,66C 'angular':10A,18B,41B,77C 'attack':46B 'cli':11A,42B,78C 'code':8A,38B,58B,68C 'could':36B 'cve':12A,15A 'develop':20B,50B,61B 'developer-tool':19B 'execut':37B,69C 'get':48B 'jetbrain':22B,26B,63C 'loader':44B,80C 'malici':54B 'may':56B 'open':2A,32B,52B 'possibl':71C 'project':5A,35B,55B,74C 'run':7A,57B 'runtim':23B 'schemat':43B,79C 'tool':21B 'untrust':4A,34B,73C 'via':9A,75C 'webstorm':1A,24B,27B,64C","nicknames":[],"mitigations":[],"who_affected":"Developers who open projects they do not trust in WebStorm, especially Angular projects, can be exposed when the Angular CLI schematics loader runs. Teams that only open their own trusted repositories are at lower risk. unknown whether the sources specify the exact trust prompt behaviour.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["angular","developertools","jetbrains","medium","runtime","webstorm"],"campaign_type":null,"search_a":"'-123322':14A,17A '-2026':13A,16A 'angular':10A 'cli':11A 'code':8A 'cve':12A,15A 'open':2A 'project':5A 'run':7A 'untrust':4A 'via':9A 'webstorm':1A","search_b":"'2026.2.4':31B '2026.3':29B 'angular':18B,41B 'attack':46B 'cli':42B 'code':38B,58B 'could':36B 'develop':20B,50B,61B 'developer-tool':19B 'execut':37B 'get':48B 'jetbrain':22B,26B 'loader':44B 'malici':54B 'may':56B 'open':32B,52B 'project':35B,55B 'run':57B 'runtim':23B 'schemat':43B 'tool':21B 'untrust':34B 'webstorm':24B,27B","search_c":"'2026.2.4':67C '2026.3':66C 'angular':77C 'cli':78C 'code':68C 'execut':69C 'jetbrain':63C 'loader':80C 'possibl':71C 'project':74C 'schemat':79C 'untrust':73C 'via':75C 'webstorm':64C","first_public_at":"2026-11-06T11:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123322","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123322","severity":null,"published_at":"2026-11-06T11:17:11+00:00","modified_at":"2026-11-06T11:17:11+00:00","first_seen_at":"2026-11-06T11:41:27+00:00","fetched_at":"2026-11-06T11:41:27+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}