JetBrains GoLand EUVD-2026-38005

Exploitation requires the victim to open or import an untrusted/attacker-supplied project in a vulnerable GoLand build (before 2026.1.3) where the project's configuration is trusted and processed by the IDE - this matches the UI:R in the CVSS vector. No authentication to the IDE is needed (PR:N), and no special server-side configuration is required. The principal limiting factor is the mandatory user interaction (the developer must actively open the hostile project), and exploitation is gated to systems running an unpatched GoLand version; it is not a remote, no-interaction attack against a listening service.

The signals are mixed and point to elevated-but-not-emergency risk. CVSS 8.8 is driven by AV:N/AC:L/PR:N with full C/I/A impact, but the same vector carries UI:R - exploitation depends on a developer actively opening a hostile project, which materially lowers real-world likelihood. This is corroborated by CISA SSVC (Exploitation: none, Automatable: no, Technical Impact: partial) and by the low EPSS score (0.21%, 11th percentile). It is not on CISA KEV and no POC is known. The 'partial' technical impact in SSVC sits in tension with the 'High' CIA in CVSS; SSVC's 'partial' likely reflects that code runs only in the developer's user context, not full system takeover. Net: a credible RCE worth patching promptly on developer endpoints, but not a mass-exploitable, automatable internet-facing threat. The mitigating factor - required user interaction with an untrusted project - is the key differentiator from a wormable network RCE.

An attacker publishes a Go repository (or sends one to a target developer) that contains crafted project/configuration files. When the developer clones and opens it in a vulnerable GoLand build, the IDE processes the untrusted configuration during project load and executes attacker-controlled code on the developer's workstation. No public POC has been identified, and the attack hinges on the victim choosing to open the malicious project.