WebStorm runs code via Grunt and Gulp task loading in untrusted projects
Opening a strange project in this web development editor can get your PC hacked.
Summary
WebStorm can execute code when it loads Grunt and Gulp tasks from an untrusted project. WebStorm users who open untrusted projects are affected.
Affected when
- Opening an untrusted project
What to do
Update to 2026.3 or 2026.2.3 or later.
Update to at least the version for your product:
- JetBrains WebStorm 2026.3 2026.3 or later
- JetBrains WebStorm 2026.2 2026.2.3 or later
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen