Nixpkgs security tracker

Permalink CVE-2026-64806

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 week, 4 days ago by @LeSuisse Activity log

Created suggestion 1 week, 5 days ago
@LeSuisse accepted 1 week, 4 days ago
@LeSuisse published on GitHub 1 week, 4 days ago

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible …

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

WebStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.webstorm

Web IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.3
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@baldo Andreas Baldeau <andreas@baldeau.net>
@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Permalink CVE-2026-64804

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 week, 4 days ago by @LeSuisse Activity log

Created suggestion 1 week, 5 days ago
@LeSuisse accepted 1 week, 4 days ago
@LeSuisse published on GitHub 1 week, 4 days ago

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible …

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

WebStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.webstorm

Web IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.3
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@baldo Andreas Baldeau <andreas@baldeau.net>
@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Permalink CVE-2026-64805

8.4 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 week, 4 days ago by @LeSuisse Activity log

Created suggestion 1 week, 5 days ago
@LeSuisse accepted 1 week, 4 days ago
@LeSuisse published on GitHub 1 week, 4 days ago

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible …

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

WebStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.webstorm

Web IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.3
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@baldo Andreas Baldeau <andreas@baldeau.net>
@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Permalink CVE-2026-64807

7.8 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Local (L)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): Required (R)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)
Modified Attack Vector (MAV): Local (L)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): Required (R)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): High (H)

updated 1 week, 4 days ago by @LeSuisse Activity log

Created suggestion 1 week, 5 days ago
@LeSuisse accepted 1 week, 4 days ago
@LeSuisse published on GitHub 1 week, 4 days ago

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible …

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Affected products

WebStorm

<2026.2

Matching in nixpkgs

pkgs.jetbrains.webstorm

Web IDE from JetBrains

nixos-unstable 2026.1.3
- nixpkgs-unstable 2026.1.3
- nixos-unstable-small 2026.1.4
nixos-26.05 2026.1.3
- nixos-26.05-small 2026.1.3
- nixpkgs-26.05-darwin 2026.1.3

Package maintainers

@baldo Andreas Baldeau <andreas@baldeau.net>
@theCapypara Marco Köpcke <hello@capypara.de>
@leona-ya Leona Maroni <nix@leona.is>
@tymscar Oscar Molnar <oscar@tymscar.com>
@jamesward James Ward <james@jamesward.com>

Suggestions search

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.webstorm

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.webstorm

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.webstorm

Package maintainers

References

Affected products

Matching in nixpkgs

pkgs.jetbrains.webstorm

Package maintainers