First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-123322

MediumCVSS 6.3/10Last modified Nov 10, 2026

Description

In JetBrains WebStorm before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Angular CLI schematics loader

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
JetBrains	WebStorm	< 2026.3, 2026.2.4

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Timeline

Published: Nov 6, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1233238.4In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send CVE-2026-1233247.7In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible CVE-2026-1233257.1In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sand CVE-2026-1233267.1In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension CVE-2026-1233277.5In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions CVE-2026-1233286.4In JetBrains YouTrack before 2026.2.19656 app permission bypass allowed privilege escalation via project tab CVE-2026-1233295.4In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions CVE-2026-1233305.4In JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only access to change issue visibility settings CVE-2026-1233315.4In JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted child articles CVE-2026-1233324.7In JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage VCS hosting server configurations CVE-2026-1233333.8In JetBrains YouTrack before 2026.2.19562 sprint creation allowed moving issues from inaccessible projects between sprints CVE-2026-1233343.8In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project

CVE-2026-123322: Medium severity, CVSS 6.3 | Vulnix