EUVD-2026-38005
GHSA-hmp8-wrw4-r24c
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Project files are obtained over the network and opened without prior auth (AV:N/PR:N), but require the developer to open the malicious project (UI:R), giving full code execution in the user context (C/I/A:H).
Primary rating from Vendor (JetBrains).
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration
AnalysisAI
Remote code execution in JetBrains GoLand before 2026.1.3 lets an attacker run arbitrary code on a developer's machine when the victim opens a maliciously crafted project whose configuration is untrusted. The flaw, reported by JetBrains itself and assigned CVSS 8.8 with high confidentiality, integrity, and availability impact, requires the user to open the booby-trapped project (UI:R) but no prior authentication on the IDE. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.21% (11th percentile).
Technical ContextAI
GoLand is JetBrains' IDE for the Go programming language, built on the IntelliJ platform. The single affected CPE is cpe:2.3:a:jetbrains:goland (all versions below 2026.1.3). The root cause is classified as CWE-73 (External Control of File Name or Path): project configuration files shipped inside an untrusted project can influence which file paths the IDE reads, writes, or executes during project load/indexing. IntelliJ-family IDEs auto-load per-project settings (build tasks, run configurations, tool paths) when a project is opened, so attacker-controlled path values in that configuration can be steered toward executing attacker-supplied content, yielding code execution in the user's context.
RemediationAI
Upgrade to GoLand 2026.1.3 or later (Vendor-released patch: 2026.1.3), which is available from the vendor and documented at https://www.jetbrains.com/privacy-security/issues-fixed/. Until the upgrade is applied, do not open or import projects from untrusted sources, and use GoLand's 'Open in Safe Mode / preview' option (which defers loading and trusting project configuration and executing project tasks) when inspecting unfamiliar repositories - the trade-off is reduced IDE functionality (no automatic indexing, build, or run configuration) until the project is explicitly trusted. Organizationally, restrict where developers clone code from and scan/triage third-party project files before opening them in the IDE.
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-contro
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. Rated high severity (
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1,
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentia
In JetBrains GoLand before 2025.1 an XXE during debugging was possible. Rated medium severity (CVSS 4.1), this vulnerabi
Same weakness CWE-73 – External Control of File Name or Path
View allShare
External POC / Exploit Code
Leaving vuln.today