CVE-2026-64802
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In JetBrains GoLand before 2026.2, arbitrary code execution was possible before granting project trust in the Go Modules integration.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code in the context of the IDE, potentially leading to compromise of the development system.
Recommendation
It is recommended to immediately update JetBrains GoLand to version 2026.2 or later.
Other vulnerabilities in JetBrains GoLand
See all- CVE-2026-86506Medium
In JetBrains GoLand before 2026.2.2.1, missing authentication on the GoLand profiler's injected pprof server exposed profiling data.
- CVE-2026-64803High
In JetBrains GoLand before 2026.2, arbitrary code execution was possible before granting project trust via the configured Go SDK.
- CVE-2026-64800Low
In JetBrains GoLand before 2026.2 sensitive configuration values are written to log files by default.
- CVE-2026-53915High
In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration.
Original NVD description (English source)
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration
Vulnerability data from NVD (NIST) · CISA KEV · EPSS