EUVD-2026-48228
GHSA-7pxx-mh46-9ggr
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local delivery of a crafted project (AV:L) requires the developer to open it (UI:R) but no attacker credentials (PR:N); code runs as the user granting full C/I/A within an unchanged scope.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK
AnalysisAI
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-controlled code via the configured Go SDK before the user grants project trust, bypassing the trust-boundary safeguard meant to gate execution. Any developer who merely opens a crafted repository (for example, cloned from a public source) can be compromised without ever clicking 'Trust Project'. This is a CWE-94 code injection weakness with a CVSS 7.8; no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
GoLand is JetBrains' dedicated Go IDE built on the IntelliJ Platform, which implements a 'project trust' model designed to prevent code in an untrusted, freshly opened project from executing automatically. The flaw is a CWE-94 (Improper Control of Generation of Code / code injection) issue in how the IDE resolves and invokes the Go SDK: project-scoped configuration can point the SDK/toolchain to attacker-supplied binaries or scripts that the IDE executes during project loading or indexing - before the trust prompt is honored. Because the Go SDK path and related build/toolchain settings are stored within the project's own configuration, an attacker who controls the repository controls what the IDE runs, defeating the sandbox/trust gate that normally requires explicit user consent before any project code runs.
RemediationAI
Vendor-released patch: upgrade GoLand to 2026.2 or later, which is the fixed release per the description; obtain it via the JetBrains Toolbox App or the in-IDE updater and confirm details against the vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ . Until updated, do not open untrusted or unfamiliar Go repositories in vulnerable GoLand versions, and when cloning third-party code inspect the project's Go SDK/toolchain configuration before loading it in the IDE; opening such projects in a disposable VM or container limits blast radius at the cost of workflow friction. Avoid configuring or accepting a Go SDK path that originates from the project itself, and where possible pin a single trusted system-wide Go SDK so project-supplied SDK settings are not honored - noting this may break projects that legitimately expect a project-local toolchain.
Remote code execution in JetBrains GoLand before 2026.1.3 lets an attacker run arbitrary code on a developer's machine w
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. Rated high severity (
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1,
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentia
In JetBrains GoLand before 2025.1 an XXE during debugging was possible. Rated medium severity (CVSS 4.1), this vulnerabi
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today