Description

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-11-06T11:17:11.723Z",
  "pubdate": "2026-11-06T11:17:11.723Z",
  "executiveSummary": "This vulnerability involves an arbitrary code execution flaw within JetBrains WebStorm stemming from the insecure loading of Grunt and Gulp tasks in untrusted project environments.\nThe vulnerability allows an attacker to achieve remote code execution (RCE) by tricking a user into opening a malicious project directory containing specially crafted task runner configuration files.\nAffected products include JetBrains WebStorm versions prior to 2026.3, specifically including version 2026.2.3.\nThe risk is categorized as high, as it enables local attackers or malicious project contributors to execute arbitrary commands with the privileges of the user running the IDE.\nSuccessful exploitation requires the victim to interact with an untrusted project, triggering the automated task discovery or loading mechanisms that the IDE performs upon project initialization.\nNo explicit network exposure is required for the initial entry, as the attack vector is file-system based; however, the impact is critical due to the potential for full system compromise.",
  "technicalDetails": "The vulnerability originates from the automated discovery and execution logic implemented within JetBrains WebStorm's integration layer for task runners, specifically Grunt and Gulp.\nThe root cause lies in the IDE's behavior of automatically parsing and executing code found within configuration files (such as Gruntfile.js or Gulpfile.js) during the project indexing and task detection phase.\nWhen a user opens a project, the IDE attempts to scan for available build tasks to populate the 'Gulp/Grunt' tool windows. If the project contains malicious JavaScript code within these configuration files, the IDE executes this code within the context of the host application process.\nAttackers can leverage this by creating a project directory containing a malicious Gruntfile or Gulpfile. Upon the user opening the project in WebStorm, the IDE's task runner provider invokes the local Node.js environment to evaluate the configuration files.\nBecause the IDE environment often has extensive access to the host file system and local shell, the arbitrary JavaScript execution leads to immediate code execution without requiring further user interaction once the project has been opened.\nThe attack flow is as follows: 1) The attacker distributes a project folder containing a malicious task configuration script. 2) The victim opens the directory in WebStorm. 3) WebStorm's task discovery mechanism triggers the execution of the configuration script to retrieve metadata. 4) The payload executes within the IDE process space. 5) The attacker gains the capability to execute system commands, access environment variables, or exfiltrate sensitive files.\nThe vulnerability is present in JetBrains WebStorm versions before 2026.3, including 2026.2.3. No specific authentication is required, as the vulnerability is triggered by the standard project-opening workflow. There are no privilege requirements beyond the user possessing permission to open the project folder.\nPost-exploitation, an attacker can maintain persistence, install backdoors, or pivot to internal network resources available to the user. The impact is essentially equivalent to local user-level compromise."
}