EUVD-2026-48227
GHSA-qc93-vrfp-c4mv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Go project with hostile modules
-
DeliveryLure developer to open it in GoLand
-
ExploitGo Modules integration processes untrusted content
-
ExecutionCode executes before trust prompt
-
ImpactArbitrary code runs in developer context
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim developer to open (or otherwise load) an attacker-supplied Go project in GoLand, and the malicious project must exercise the Go Modules integration - this is the specific feature that runs project-controlled code before trust is granted. Limiting factors: the CVSS vector is AV:L with UI:R, so the attacker cannot trigger this remotely or without the victim's action; the victim must actually open the crafted project. No authentication is required of the attacker (PR:N) and the trust prompt does not protect the user, so a cautious developer who intends to inspect-before-trusting is still exposed. Affects only GoLand versions before 2026.2. |
| Impact | The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a local attack vector requiring user interaction (the developer must open the malicious project) but no prior authentication or privileges, yielding full confidentiality, integrity and availability impact via code execution in the user's context. There is no EPSS score, no KEV listing, and no known POC in the provided data, so exploitation is currently theoretical rather than observed - this is a developer-workstation supply-chain-style risk rather than a mass-exploited network flaw. The realistic risk is meaningful for anyone who reviews or clones untrusted Go repositories, because the 'trust prompt' users rely on does not actually stop this attack; however, the local vector and required user interaction (opening the project) limit scale. Note the AV:L/UI:R combination means this cannot be triggered remotely without the victim taking an action, so despite the High score it is not a wormable or drive-by network threat. |
| Exploit ScenarioDerived | An attacker publishes a Go repository containing a crafted go.mod / Go Modules configuration on a public host and lures a developer into opening it in GoLand (e.g., to review a pull request, evaluate a library, or investigate a 'bug report'). When the developer opens the project, the Go Modules integration processes the malicious content and executes attacker code before the trust prompt is honored, giving the attacker code execution in the developer's user context. No public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code through the Go Modules integration before the developer explicitly grants project trust. Because the trust prompt is meant to be the safeguard against exactly this, opening or previewing a crafted repository is sufficient for compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Vendor-released patch: 2026.2 - upgrade GoLand to version 2026.2 or later, which enforces the project trust gate before the Go Modules integration can execute project-controlled code. Until upgraded, do not open, clone, or preview Go projects from untrusted or unverified sources, and treat any repository from an external party as untrusted code that could execute on open; where possible open unknown projects in a disposable VM or container rather than on a primary developer workstation. Because the trust prompt itself is bypassed by this flaw, relying on 'answering the trust dialog carefully' is not a sufficient workaround - the only reliable fix is the update. Refer to the JetBrains advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for the authoritative fixed-version listing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GoLand is JetBrains' dedicated IDE for the Go programming language, built on the IntelliJ platform. Modern JetBrains IDEs implement a 'project trust' model: when a project is opened, potentially dangerous automatic actions (build tools, module resolution, code generation, run configurations) are supposed to be gated behind an explicit user trust decision to protect against opening untrusted code from the internet. This flaw is classified as CWE-94 (Improper Control of Generation of Code / Code Injection): the Go Modules integration performs module resolution/processing that executes or evaluates project-controlled logic before the trust gate is enforced, meaning the safeguard is bypassed. The root cause is an ordering/enforcement gap where untrusted project content reaches a code-executing pathway prior to the trust check.
Know when Goland gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector because the victim must open a malicious project (UI:R); no attacker auth needed (PR:N); code execution in user context yields full C/I/A impact.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration
Executive ViewAI
JetBrains GoLand before version 2026.2 contains a critical vulnerability allowing arbitrary code execution on developer machines when opening malicious Go projects, bypassing the built-in trust safeguards. This exposes development environments to unauthenticated compromise and creates direct supply chain risk for organizations using affected GoLand versions.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict opening of external or untrusted Go projects until upgraded, mandate code review of all new Go dependencies before import, isolate developers working with external code to sandboxed environments, and deploy endpoint detection and response monitoring on development workstations to identify suspicious process execution during Go module operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in JetBrains GoLand before 2026.1.3 lets an attacker run arbitrary code on a developer's machine w
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-contro
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. Rated high severity (
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1,
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentia
In JetBrains GoLand before 2025.1 an XXE during debugging was possible. Rated medium severity (CVSS 4.1), this vulnerabi
Exploit-DB