EUVD-2026-48228
GHSA-7pxx-mh46-9ggr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Go project with hostile SDK config
-
DeliveryDeliver repository via clone/PR/sample
-
ExploitVictim opens project in vulnerable GoLand
-
ExecutionConfigured Go SDK runs before trust prompt
-
ImpactExecute arbitrary code as developer
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Code injection prevention, sandbox exec
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a victim developer open an attacker-supplied Go project in JetBrains GoLand prior to version 2026.2 (UI:R - user interaction is mandatory), and that the project carry a malicious Go SDK/toolchain configuration that the IDE resolves and executes during load, before the 'Trust Project' consent is granted. It is a local vector (AV:L): the attacker delivers a repository the victim opens rather than exploiting a network service. Limiting factors are that the developer must actually open the crafted project, the flaw is fixed in 2026.2 (patched installs are not exploitable), and impact is bounded to the developer's user privileges (S:U, no scope change). No authentication is required of the attacker (PR:N) - the victim's action, not credentials, is the trigger. |
| Impact | The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) accurately frames this as a local, low-complexity, unauthenticated attack that requires user interaction (opening the project) and yields full confidentiality, integrity, and availability impact - i.e., code execution as the developer. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no POC was referenced, so real-world exploitation signal is currently absent: no public exploit identified at time of analysis. The practical risk is meaningful because the social-engineering step (get a developer to open a repository) is trivial and common in developer workflows, but it is not a mass-automatable remote flaw - it is opportunistic and interaction-gated. This is a genuine developer-workstation supply-chain/trust-bypass concern rather than a high-CVSS-but-negligible-risk issue, though the local vector and required user action keep it below internet-facing critical severity. |
| Exploit ScenarioDerived | An attacker publishes a Go repository (or submits a pull request/sample project) containing a malicious project configuration that points the Go SDK to an attacker-controlled binary. A developer clones and opens the project in GoLand before 2026.2; during project loading the configured SDK executes without the trust prompt ever gating it, running the attacker's code on the developer's machine with the developer's privileges. No public POC was referenced in the input. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 23, 2026
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-controlled code via the configured Go SDK before the user grants project trust, bypassing the trust-boundary safeguard meant to gate execution. Any developer who merely opens a crafted repository (for example, cloned from a public source) can be compromised without ever clicking 'Trust Project'. This is a CWE-94 code injection weakness with a CVSS 7.8; no public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade GoLand to 2026.2 or later, which is the fixed release per the description; obtain it via the JetBrains Toolbox App or the in-IDE updater and confirm details against the vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/ . Until updated, do not open untrusted or unfamiliar Go repositories in vulnerable GoLand versions, and when cloning third-party code inspect the project's Go SDK/toolchain configuration before loading it in the IDE; opening such projects in a disposable VM or container limits blast radius at the cost of workflow friction. Avoid configuring or accepting a Go SDK path that originates from the project itself, and where possible pin a single trusted system-wide Go SDK so project-supplied SDK settings are not honored - noting this may break projects that legitimately expect a project-local toolchain.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GoLand is JetBrains' dedicated Go IDE built on the IntelliJ Platform, which implements a 'project trust' model designed to prevent code in an untrusted, freshly opened project from executing automatically. The flaw is a CWE-94 (Improper Control of Generation of Code / code injection) issue in how the IDE resolves and invokes the Go SDK: project-scoped configuration can point the SDK/toolchain to attacker-supplied binaries or scripts that the IDE executes during project loading or indexing - before the trust prompt is honored. Because the Go SDK path and related build/toolchain settings are stored within the project's own configuration, an attacker who controls the repository controls what the IDE runs, defeating the sandbox/trust gate that normally requires explicit user consent before any project code runs.
Know when Goland gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local delivery of a crafted project (AV:L) requires the developer to open it (UI:R) but no attacker credentials (PR:N); code runs as the user granting full C/I/A within an unchanged scope.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK
Executive ViewAI
JetBrains GoLand IDE versions before 2026.2 contain an arbitrary code execution vulnerability that compromises developer machines when opening malicious repositories. Attackers can execute code through the Go SDK initialization without requiring developer interaction or project trust acknowledgment, creating supply-chain risk for teams cloning public code.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict GoLand usage to trusted internal projects only; (2) Sandbox GoLand in isolated development containers without access to production systems or credentials; (3) Disable automatic SDK initialization and require manual configuration per project; (4) Use alternative IDEs for open-source or third-party code review until patched version is available; (5) Monitor SDK process execution for suspicious behavior.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in JetBrains GoLand before 2026.1.3 lets an attacker run arbitrary code on a developer's machine w
The embedded browser in JetBrains desktop IDEs - IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CL
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. Rated high severity (
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1,
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentia
In JetBrains GoLand before 2025.1 an XXE during debugging was possible. Rated medium severity (CVSS 4.1), this vulnerabi
Exploit-DB