In JetBrains WebStorm prior to 2021.1, code execution without user confirmation was possible for untrusted projects.