EUVD-2026-48227
GHSA-qc93-vrfp-c4mv
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local vector because the victim must open a malicious project (UI:R); no attacker auth needed (PR:N); code execution in user context yields full C/I/A impact.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration
AnalysisAI
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code through the Go Modules integration before the developer explicitly grants project trust. Because the trust prompt is meant to be the safeguard against exactly this, opening or previewing a crafted repository is sufficient for compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
GoLand is JetBrains' dedicated IDE for the Go programming language, built on the IntelliJ platform. Modern JetBrains IDEs implement a 'project trust' model: when a project is opened, potentially dangerous automatic actions (build tools, module resolution, code generation, run configurations) are supposed to be gated behind an explicit user trust decision to protect against opening untrusted code from the internet. This flaw is classified as CWE-94 (Improper Control of Generation of Code / Code Injection): the Go Modules integration performs module resolution/processing that executes or evaluates project-controlled logic before the trust gate is enforced, meaning the safeguard is bypassed. The root cause is an ordering/enforcement gap where untrusted project content reaches a code-executing pathway prior to the trust check.
RemediationAI
Vendor-released patch: 2026.2 - upgrade GoLand to version 2026.2 or later, which enforces the project trust gate before the Go Modules integration can execute project-controlled code. Until upgraded, do not open, clone, or preview Go projects from untrusted or unverified sources, and treat any repository from an external party as untrusted code that could execute on open; where possible open unknown projects in a disposable VM or container rather than on a primary developer workstation. Because the trust prompt itself is bypassed by this flaw, relying on 'answering the trust dialog carefully' is not a sufficient workaround - the only reliable fix is the update. Refer to the JetBrains advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ for the authoritative fixed-version listing.
Remote code execution in JetBrains GoLand before 2026.1.3 lets an attacker run arbitrary code on a developer's machine w
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-contro
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. Rated high severity (
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1,
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentia
In JetBrains GoLand before 2025.1 an XXE during debugging was possible. Rated medium severity (CVSS 4.1), this vulnerabi
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today