The vulnerability allows an attacker to execute arbitrary code within the JetBrains WebStorm environment by taking advantage of Grunt and Gulp task loading when an untrusted project is opened. Because the IDE performs task loading without properly restricting operations, the flaw is identified as CWE‑829, enabling arbitrary code execution that can compromise the host system, steal data, and grant full control over the developer’s workstation.

All JetBrains WebStorm installations older than version 2026.3 are affected. No more specific sub‑version details are provided, so any build prior to 2026.3 is considered exposed until a patch is applied.

The CVSS score of 7.8 signals high severity, while the EPSS score is not available and it is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker supplies an untrusted project file that is opened within the IDE, allowing the flouted Grunt or Gulp task to run with the user's privileges. This can lead to full system compromise if exploited.