Vendors / JetBrains Records 788 All Threatist records
Exploited (KEV) 4
CVSS critical 84
CVSS high 249
Exploited now JetBrains records in CISA KEV
Components Products in the NVD configurations · select one to filter the records Priority HIGH 75
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4,…
CVSS 3.1 CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.04883 · Published 2024-06-10 · Fixed in 2023.1.7, 2023.2.7 +19 CWE-522
Priority MEDIUM 45
In JetBrains WebStorm before 2021.1, code execution without user confirmation was possible for untrusted projects.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01541 · Published 2021-05-11 · No fix listed
Priority MEDIUM 44
JetBrains IntelliJ IDEA 2021.3.1 Preview, IntelliJ IDEA 2021.3.1 RC, PyCharm Professional 2021.3.1 RC, GoLand 2021.3.1, PhpStorm 2021.3.1 Preview, PhpStorm 2021.3.1 RC, RubyMine 2021.3.1 Preview, RubyMine 2021.3.1 RC, CL…
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01083 · Published 2022-02-25 · No fix listed
Priority LOW 38
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter
CVSS 3.1 HIGH 8.4· Local · No auth · No interaction · EPSS 0.00192 · Published 2026-07-23 · Fixed in 2026.2 CWE-829
Priority LOW 38
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling
CVSS 3.1 HIGH 8.4· Local · No auth · No interaction · EPSS 0.00192 · Published 2026-07-23 · Fixed in 2026.2 CWE-829
Priority LOW 38
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling
CVSS 3.1 HIGH 8.4· Local · No auth · No interaction · EPSS 0.00192 · Published 2026-07-23 · Fixed in 2026.2 CWE-829
Priority LOW 35
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration
CVSS 3.1 HIGH 7.8· Local · No auth · User interaction · EPSS 0.00185 · Published 2026-07-23 · Fixed in 2026.2 CWE-829
Priority LOW 35
In JetBrains WebStorm before 2024.3 code execution in Untrusted Project mode was possible via type definitions installer script
CVSS 3.1 HIGH 7.8· Local · No auth · User interaction · EPSS 0.00112 · Published 2024-11-15 · Fixed in 2024.3 CWE-349
Priority LOW 34
In JetBrains WebStorm before 2021.1, HTTP requests were used instead of HTTPS.
CVSS 3.1 HIGH 7.5· Network · No auth · No interaction · EPSS 0.00628 · Published 2021-05-11 · No fix listed CWE-319
Open these records in search → All records by CVSS severity
84 249 403 52 0
THREATIST.IORead the docs