Executive brief
JetBrains GoLand, a popular development environment for the Go programming language, contained a vulnerability that could allow malicious code to run on a developer's machine. This could occur when a user opens a project but before they have explicitly granted 'trust' to that project. An attacker could use this to gain full control over the user's workstation, potentially leading to data theft or further network intrusion.
Technical details
A code injection vulnerability (CWE-94) existed in JetBrains GoLand versions prior to 2026.2. The flaw resided in how the IDE handled the configured Go SDK when opening a project, failing to properly restrict execution until the user explicitly granted project trust. An attacker could exploit this by convincing a user to open a malicious project, leading to arbitrary code execution with the privileges of the IDE user. The vulnerability is addressed in version 2026.2.
Affected products
- JetBrains GoLand before 2026.2
Timeline
- 2026-07-23: advisory: NVD record published
- 2026-07-23: patched: Fixed in version 2026.2