2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| JetBrains | WebStorm | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
| Link | Providers |
|---|---|
| https://www.jetbrains.com/privacy-security/issues-fixed/ |
|
Fri, 06 Nov 2026 12:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | Code Execution via Untrusted Angular CLI Schematics Loader in WebStorm |
Fri, 06 Nov 2026 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader | |
| Weaknesses | CWE-829 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: JetBrains
Published:
Updated: 2026-11-06T10:28:06.467Z
Reserved: 2026-11-05T18:38:28.086Z
Link: CVE-2026-123322
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-06T11:17:11.860
Modified: 2026-11-06T11:17:11.860
Link: CVE-2026-123322
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-06T11:45:03Z