# CVE-2026-64802: JetBrains GoLand arbitrary code execution in Go Modules integration

Source: https://junglewise.ai/threats/cve-2026-64802-jetbrains-goland-arbitrary-code-execution-in-go-modules  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-23. Updated: 2026-07-23  
License: CC BY 4.0 with a link back

CVE-2026-64802 · Severity: high · CVSS 7.8 · Published 2026-07-23

JetBrains GoLand, a popular development environment for the Go programming language, contained a vulnerability that could allow malicious code to run on a developer's computer. This could happen automatically when opening a project, even before the user has explicitly chosen to 'trust' the project files. An attacker could use this to gain full control over a developer's workstation, potentially stealing source code, credentials, or sensitive company data.

Technologies: [Jetbrains GoLand](https://junglewise.ai/threats/technologies/goland). Vendors: [Jetbrains](https://junglewise.ai/threats/vendors/jetbrains).

## Quick answers

**Is CVE-2026-64802 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-64802 being exploited in the wild.

**How severe is CVE-2026-64802?** High severity, with a CVSS score of 7.8, published 23 July 2026.

**Which products and versions are affected?** Jetbrains GoLand before 2026.2.

**Is there a fix for CVE-2026-64802?** A patch was published on 2026-07-23: Fixed in version 2026.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-64802 attacked?** It is attacked with local access, in a network appliance.

**Am I affected by CVE-2026-64802?** Check whether you run Jetbrains GoLand at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An arbitrary code execution vulnerability exists in JetBrains GoLand's Go Modules integration. The flaw stems from improper control of code generation (CWE-94) where the IDE may execute commands or scripts associated with Go modules automatically upon opening a project. Crucially, this execution occurs before the 'Project Trust' security mechanism can intervene. An attacker can exploit this by tricking a user into opening a specially crafted project locally. Successful exploitation allows for full system compromise under the context of the current user. The issue is resolved in GoLand version 2026.2.

## Affected products

- JetBrains GoLand before 2026.2

## Timeline

- 2026-07-23: advisory: CVE-2026-64802 published by JetBrains
- 2026-07-23: patched: Fixed in version 2026.2

## References

- [https://www.jetbrains.com/privacy-security/issues-fixed/](https://www.jetbrains.com/privacy-security/issues-fixed/)

## Related threats

- [JetBrains Toolbox App and IDEs compromised certificate trust](https://junglewise.ai/threats/cve-2026-118697-in-jetbrains-toolbox-app-before-3-9-1-and-3-8-2-intellij-idea)
- [JetBrains IDEs embedded browser trusted revoked certificates](https://junglewise.ai/threats/cve-2026-118696-in-jetbrains-intellij-idea-pycharm-phpstorm-rubymine-and)
- [JetBrains GoLand missing authentication in profiler's pprof server](https://junglewise.ai/threats/cve-2026-86506-jetbrains-goland-missing-authentication-in-profiler-s-pprof)
- [JetBrains GoLand arbitrary code execution via Go SDK](https://junglewise.ai/threats/cve-2026-64803-jetbrains-goland-arbitrary-code-execution-via-go-sdk)
- [JetBrains GoLand sensitive information disclosure in log files](https://junglewise.ai/threats/cve-2026-64800-jetbrains-goland-sensitive-information-disclosure-in-log-files)