In JetBrains WebStorm prior to version 2026.3, loading an untrusted project that contains Angular CLI schematics can trigger arbitrary code execution during the schematics loader phase. This flaw allows an attacker to run malicious code with the privileges of the user running WebStorm, exposing the system to full compromise. The weakness is classified as CWE-829, which describes improper resource handling leading to unintended execution paths.

JetBrains WebStorm versions older than 2026.3 are affected. Any user who opens or imports an untrusted project containing potentially malicious Angular CLI schematics is at risk. The vulnerability manifests only in projects that rely on the default schematics loader; it does not affect the core IDE functionality outside that context.

The CVSS score of 6.3 indicates moderate severity. The EPSS score is currently unavailable, so the current exploitation probability is unclear, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is local; an attacker must supply or otherwise provide an untrusted project file that WebStorm processes. An attacker who can access the workstation or inject a malicious project can exploit this flaw without network access, making it a significant risk for environments where untrusted code is opened.