A flaw in JetBrains PhpStorm allows an attacker to execute arbitrary code before the project is granted trust, via the configured interpreter. This creates a severe remote code execution risk, where malicious code can run with the privileges of the user running the IDE. The weakness is mapped to CWE‑829, indicating a configuration or environment error that leads to code execution.

All installations of JetBrains PhpStorm released before version 2026.2 are affected. Users who have not yet upgraded to 2026.2 or later are vulnerable. The issue does not affect other JetBrains products mentioned in the CNA data.

Based on the description, the likely attack vector is inferred to involve an attacker supplying a malicious interpreter configuration or project file that PhpStorm processes before the project trust dialog appears. The CVSS score of 8.4 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates a very low probability of exploitation at this time, and the CVE is not listed in the CISA KEV catalog. Once the interpreter is executed, arbitrary code runs in the context of the IDE user, potentially compromising the local system.