CVE-2026-64807: 
NixOS 脆弱性の分析と軽減

CVE-2026-64807 is an arbitrary code execution vulnerability in JetBrains WebStorm caused by improper handling of project-supplied linter configurations. It affects all WebStorm versions before 2026.2 and was disclosed on July 23, 2026, by JetBrains. The vulnerability carries a CVSS v3.1 base score of 7.8 (High), assigned by JetBrains as the CNA (JetBrains Advisory, NVD).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), meaning WebStorm loads and executes linter configuration files supplied by a project without sufficient validation or sandboxing. An attacker can craft a malicious linter configuration file (e.g., an ESLint or Stylelint config) within a project repository; when a victim opens the project in a vulnerable WebStorm version, the IDE automatically processes the configuration and executes attacker-controlled code. Exploitation requires local access to the target machine and user interaction (opening the malicious project), but no privileges are required (JetBrains Advisory, NVD).

Successful exploitation results in arbitrary code execution in the context of the user running WebStorm, with high impact to confidentiality, integrity, and availability. An attacker could read sensitive files, modify project data, install persistent malware, or use the compromised developer workstation as a pivot point for lateral movement into internal networks or CI/CD pipelines. The scope is limited to the affected system (unchanged scope), but developer machines typically have access to source code repositories, credentials, and internal services, amplifying the potential damage (NVD).

1. Craft malicious project: Create or fork a legitimate-looking code repository and embed a malicious linter configuration file (e.g., .eslintrc.js or eslint.config.js) that executes arbitrary code when loaded by the linter plugin — for example, by requiring a malicious Node.js module or using a plugin field pointing to attacker-controlled code.
2. Distribute the project: Share the malicious repository via a public platform (GitHub, GitLab), a phishing email, or a supply chain compromise targeting a developer's dependencies.
3. Victim opens project: The target developer opens the project in JetBrains WebStorm (any version before 2026.2). WebStorm automatically detects and loads the linter configuration as part of its IDE integration.
4. Code execution: The malicious linter configuration triggers execution of attacker-controlled code in the context of the developer's user account, enabling payload delivery such as a reverse shell, credential harvesting, or persistence mechanisms (JetBrains Advisory, NVD).

• File System: Unexpected or unfamiliar linter configuration files (.eslintrc.js, eslint.config.js, .stylelintrc.js, etc.) in project root directories containing require() calls to external or unusual modules; newly created files in user home or temp directories shortly after opening a project.
• Process: Unusual child processes spawned by the WebStorm JVM process (e.g., node, sh, bash, powershell, cmd) executing scripts not associated with normal IDE operation; unexpected network connections initiated by Node.js processes launched from within the IDE.
• Network: Outbound connections to unknown external IPs or domains from developer workstations, particularly from Node.js processes, shortly after opening a new project.
• Logs: IDE logs (idea.log) showing linter plugin loading events for unfamiliar configuration files; OS-level audit logs recording process creation events with WebStorm as the parent process.

JetBrains has addressed this vulnerability in WebStorm 2026.2; users should upgrade to this version or later immediately. As a workaround prior to upgrading, developers should avoid opening untrusted or unreviewed projects in WebStorm, and manually inspect linter configuration files for suspicious content before loading a project. Disabling automatic linter integration in IDE settings may also reduce exposure until a patch can be applied (JetBrains Advisory).