Goland
Monthly
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1, where the IDE injects a pprof HTTP server into profiled processes without any access control. An attacker with network connectivity to the developer workstation during an active profiling session can retrieve heap dumps, goroutine stacks, CPU traces, and in-memory data structures that may contain credentials, tokens, or sensitive application state. No public exploit code exists and this is not listed in CISA KEV; however, the attack requires only standard HTTP requests against an unauthenticated endpoint, making it trivially simple when the prerequisite conditions are met.
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-controlled code via the configured Go SDK before the user grants project trust, bypassing the trust-boundary safeguard meant to gate execution. Any developer who merely opens a crafted repository (for example, cloned from a public source) can be compromised without ever clicking 'Trust Project'. This is a CWE-94 code injection weakness with a CVSS 7.8; no public exploit code or active exploitation has been identified at time of analysis.
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code through the Go Modules integration before the developer explicitly grants project trust. Because the trust prompt is meant to be the safeguard against exactly this, opening or previewing a crafted repository is sufficient for compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentials and secrets to anyone with read access to IDE log output. The CWE-532 flaw affects Go developers whose project configurations contain API keys, VCS credentials, or cloud tokens - values the IDE silently captures in plaintext log entries during normal use. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the low CVSS score of 3.5 reflects the limited impact and the requirement for low privilege and user interaction.
Remote code execution in JetBrains GoLand before 2026.1.3 lets an attacker run arbitrary code on a developer's machine when the victim opens a maliciously crafted project whose configuration is untrusted. The flaw, reported by JetBrains itself and assigned CVSS 8.8 with high confidentiality, integrity, and availability impact, requires the user to open the booby-trapped project (UI:R) but no prior authentication on the IDE. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.21% (11th percentile).
In JetBrains GoLand before 2025.1 an XXE during debugging was possible. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1, where the IDE injects a pprof HTTP server into profiled processes without any access control. An attacker with network connectivity to the developer workstation during an active profiling session can retrieve heap dumps, goroutine stacks, CPU traces, and in-memory data structures that may contain credentials, tokens, or sensitive application state. No public exploit code exists and this is not listed in CISA KEV; however, the attack requires only standard HTTP requests against an unauthenticated endpoint, making it trivially simple when the prerequisite conditions are met.
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-controlled code via the configured Go SDK before the user grants project trust, bypassing the trust-boundary safeguard meant to gate execution. Any developer who merely opens a crafted repository (for example, cloned from a public source) can be compromised without ever clicking 'Trust Project'. This is a CWE-94 code injection weakness with a CVSS 7.8; no public exploit code or active exploitation has been identified at time of analysis.
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code through the Go Modules integration before the developer explicitly grants project trust. Because the trust prompt is meant to be the safeguard against exactly this, opening or previewing a crafted repository is sufficient for compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentials and secrets to anyone with read access to IDE log output. The CWE-532 flaw affects Go developers whose project configurations contain API keys, VCS credentials, or cloud tokens - values the IDE silently captures in plaintext log entries during normal use. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the low CVSS score of 3.5 reflects the limited impact and the requirement for low privilege and user interaction.
Remote code execution in JetBrains GoLand before 2026.1.3 lets an attacker run arbitrary code on a developer's machine when the victim opens a maliciously crafted project whose configuration is untrusted. The flaw, reported by JetBrains itself and assigned CVSS 8.8 with high confidentiality, integrity, and availability impact, requires the user to open the booby-trapped project (UI:R) but no prior authentication on the IDE. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.21% (11th percentile).
In JetBrains GoLand before 2025.1 an XXE during debugging was possible. Rated medium severity (CVSS 4.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.