First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-123321

HighCVSS 7.8/10Last modified Nov 7, 2026

Description

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
JetBrains	WebStorm	< 2026.3, 2026.2.3

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Timeline

Published: Nov 6, 2026
Last modified: Nov 7, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1233226.3In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader CVE-2026-1233238.4In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send CVE-2026-1233247.7In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible CVE-2026-1233257.1In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sand CVE-2026-1233267.1In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension CVE-2026-1233277.5In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions CVE-2026-1233286.4In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab CVE-2026-1233295.4In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions CVE-2026-1233305.4In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings CVE-2026-1233315.4In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles CVE-2026-1233324.7In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations CVE-2026-1233333.8In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints

CVE-2026-123321: High severity, CVSS 7.8 | Vulnix