CVE-2026-64805: 
NixOS 脆弱性の分析と軽減

CVE-2026-64805 is a local arbitrary code execution vulnerability in JetBrains WebStorm affecting all versions before 2026.2. The flaw allows code execution via project-local package-manager tooling before the user is prompted to grant project trust, meaning malicious code can run during the initial project loading phase without any user approval. It was published on July 23, 2026, and assigned a CVSS v3.1 base score of 8.4 (High) by JetBrains (GitHub Advisory, JetBrains).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), meaning WebStorm executes or includes functionality from project-local package managers (e.g., npm scripts, package.json lifecycle hooks) before the IDE's project trust mechanism has been invoked. An attacker who can supply a malicious project — for example, via a shared repository or social engineering — can embed malicious package manager scripts that execute automatically when the victim opens the project in WebStorm. No privileges are required and no user interaction beyond opening the project is needed, as the attack vector is local and attack complexity is low (GitHub Advisory, JetBrains).

Successful exploitation grants an attacker arbitrary code execution with the privileges of the WebStorm process on the victim's machine, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive files, modify project or system data, install persistent malware, or use the compromised developer workstation as a pivot point for lateral movement into internal networks or CI/CD pipelines. The scope is limited to the local system, but the developer context makes this particularly dangerous given access to source code, credentials, and deployment tooling (GitHub Advisory).

1. Prepare malicious project: Create or fork a project repository containing a crafted package.json with malicious lifecycle scripts (e.g., preinstall, postinstall) or a custom package manager configuration that executes attacker-controlled code.
2. Deliver the project: Distribute the malicious project to a target developer via a public repository, phishing link, pull request, or shared archive, enticing them to open it in JetBrains WebStorm (any version before 2026.2).
3. Trigger automatic execution: When the victim opens the project in WebStorm, the IDE invokes project-local package-manager tooling (e.g., npm) as part of its initialization routine — before displaying the project trust prompt.
4. Achieve code execution: The malicious package manager scripts execute with the privileges of the WebStorm process, enabling actions such as dropping a reverse shell, exfiltrating credentials or source code, or establishing persistence on the developer's machine (GitHub Advisory).

• Process: Unexpected child processes spawned by the WebStorm JVM process (e.g., node, npm, sh, cmd.exe) executing scripts from a newly opened project directory before any trust prompt is acknowledged.
• File System: Unexpected new files, scripts, or executables written to the user's home directory, temp directories, or project folder shortly after opening a project in WebStorm.
• Network: Outbound network connections initiated by node or npm processes to unknown external IP addresses or domains immediately after a project is opened.
• Logs: IDE or OS-level logs showing package manager invocations (e.g., npm run preinstall) triggered from within the WebStorm process context before user interaction with a trust dialog.

JetBrains has released a fix in WebStorm version 2026.2; users should upgrade immediately to this version or later (JetBrains). As a workaround prior to upgrading, exercise extreme caution when opening projects from untrusted or unknown sources, and avoid opening repositories from unfamiliar contributors. Organizations should enforce policies requiring developers to review project contents — especially package.json scripts and package manager configuration files — before opening them in the IDE.

Initial community discussion appeared on Mastodon shortly after disclosure, with at least one security researcher noting the vulnerability (Mastodon). Coverage was picked up by automated vulnerability tracking services including VulDB and CVE aggregators within hours of publication. No major vendor statements beyond JetBrains' own advisory page have been identified at this time.