Description

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-11-06T11:17:11.860Z",
  "pubdate": "2026-11-06T11:17:11.860Z",
  "executiveSummary": "A critical security vulnerability exists within JetBrains WebStorm that allows for arbitrary code execution when processing untrusted projects. The flaw resides in the Angular CLI schematics loader mechanism, which fails to properly sanitize or validate input during the project initialization or configuration process.\nSuccessful exploitation enables an attacker to execute arbitrary commands with the privileges of the user running the IDE. This poses a significant risk to developers, as simply opening a malicious project can trigger the execution of unintended code. The vulnerability is present in versions of WebStorm prior to 2026.3 and 2026.2.4. Attackers require a victim to perform the action of opening a project within the IDE, making this a client-side remote code execution scenario that circumvents standard environment security boundaries.",
  "technicalDetails": "The vulnerability stems from the unsafe handling of Angular CLI schematics within WebStorm's project environment. Angular schematics are essentially automated code generation scripts that interact with the local filesystem and the Node.js runtime. When WebStorm loads a project that defines custom or malicious schematics, the integrated loader incorrectly assumes that these schematics are trusted components of the project's development workflow.\nThe root cause is a lack of validation or sandboxing during the schematic loading and execution process. In a compromised or malicious project, an attacker can modify the angular.json configuration file or the underlying schematic files to include arbitrary JavaScript payloads. When WebStorm invokes the Angular CLI to provide features such as scaffolding or project analysis, it triggers the execution of these malicious schematics in a Node.js process managed by the IDE.\nThe attack flow begins when an attacker provides a target with a project folder containing a crafted Angular CLI configuration. Once the victim opens this directory in WebStorm, the IDE attempts to index or configure the project using the bundled or local Angular CLI infrastructure. The loader, failing to enforce strict isolation, executes the malicious code embedded within the schematics. This occurs without requiring explicit authentication or elevated privileges, as the execution occurs within the security context of the user running the WebStorm application.\nBecause the schematic execution occurs within the Node.js context utilized by the IDE, the malicious payload can perform any actions permitted by the current user's operating system permissions. This includes reading sensitive files, modifying project source code, establishing reverse shells, or installing persistent backdoors. The vulnerability effectively turns project-level configuration into a vector for system-level remote code execution. This behavior persists throughout the lifecycle of the IDE session until the malicious process is terminated or the project is closed, provided the initialization sequence has already triggered the payload. The lack of an 'untrusted project' mode enforcement for schematic execution remains the primary failure point in the architecture of the affected versions."
}