CVE-2024-52555: JetBrains WebStorm RCE Vulnerability

CVE-2024-52555 Overview

CVE-2024-52555 affects JetBrains WebStorm versions prior to 2024.3. The vulnerability allows code execution while a project is open in Untrusted Project mode, defeating the isolation guarantees that mode is designed to provide. Attackers achieve execution by leveraging the type definitions installer script, which runs despite the project being marked as untrusted.

The root weakness is tracked as [CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data]. Successful exploitation requires user interaction, specifically opening a malicious project in WebStorm.

Critical Impact
A developer who opens a hostile JavaScript or TypeScript project in Untrusted Project mode can have arbitrary code executed under their user account, leading to full compromise of the local development environment.

Affected Products

JetBrains WebStorm versions before 2024.3
Projects opened in Untrusted Project mode
Environments processing third-party type definitions

Discovery Timeline

2024-11-15 - CVE-2024-52555 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52555

Vulnerability Analysis

WebStorm ships an Untrusted Project mode that restricts automatic execution of project-supplied code when a developer opens an unfamiliar codebase. The mode is intended to block build scripts, plugin loaders, and language service integrations that could otherwise run attacker-controlled logic.

In versions before 2024.3, the type definitions installer script is invoked outside these restrictions. WebStorm treats the installer path as trusted tooling while still passing project-supplied inputs to it. This mismatch aligns with [CWE-349], where trusted execution paths accept extraneous untrusted data from the opened project.

An attacker who controls a repository can craft type definition metadata that causes the installer to execute arbitrary commands during project open. The code runs with the privileges of the WebStorm process, which is the interactive developer account.

Root Cause

The root cause is incomplete enforcement of the Untrusted Project trust boundary. The type definitions installer script bypasses the mode's execution gate, so project-controlled input reaches a code path that should have been blocked.

Attack Vector

Exploitation is local and requires user interaction. The developer must clone or download a malicious project and open it in a vulnerable WebStorm build. No authentication or elevated privileges are required from the attacker. Once the project is opened, the installer script executes without additional user prompts, giving the attacker code execution in the developer's session.

No public proof-of-concept is listed in the enriched data, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. Consult the JetBrains Security Issues Fixed advisory for vendor technical detail.

Detection Methods for CVE-2024-52555

Indicators of Compromise

Unexpected child processes spawned by the WebStorm executable shortly after a project is opened, particularly shells, package managers, or scripting interpreters.
New or modified files under the developer's home directory, SSH configuration, or shell startup scripts following a first-time project open.
Outbound network connections initiated by WebStorm or its child processes to previously unseen hosts.

Detection Strategies

Baseline the normal process tree of webstorm or webstorm64.exe and alert on deviations such as cmd.exe, powershell.exe, bash, node, or npm invocations tied to project open events.
Monitor for creation of type definition installer artifacts in project directories that were just cloned from external sources.
Correlate git clone or archive extraction events with subsequent WebStorm launches to identify risky open-project workflows.

Monitoring Recommendations

Log process creation with full command lines on developer workstations and forward the telemetry to a central analytics platform.
Track WebStorm version inventory across the fleet and flag hosts still running builds earlier than 2024.3.
Alert on modifications to persistence locations, including scheduled tasks, cron entries, and Run registry keys, that occur within minutes of a WebStorm process start.

How to Mitigate CVE-2024-52555

Immediate Actions Required

Upgrade all WebStorm installations to version 2024.3 or later, which contains the vendor fix.
Audit developer endpoints for unauthorized processes, credential access, or persistence artifacts introduced after opening untrusted projects.
Restrict developer accounts to least privilege so that any residual code execution has limited blast radius.

Patch Information

JetBrains addressed the issue in WebStorm 2024.3. Update through the JetBrains Toolbox App or by downloading the current release. Confirm remediation status against the JetBrains Security Issues Fixed page.

Workarounds

Only open repositories from trusted sources until the upgrade is complete.
Review and remove untrusted type definition packages before opening a project in WebStorm.
Isolate developer workstations that must handle third-party code in a virtual machine or container with no access to production credentials.

bash

# Verify installed WebStorm version on Linux/macOS
webstorm --version

# Windows: query the installed version via PowerShell
Get-ItemProperty "HKLM:\Software\JetBrains\WebStorm\*" | Select-Object DisplayName, DisplayVersion