CVE-2026-64802 in GoLand
Summary
by MITRE • 07/23/2026
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability in JetBrains GoLand versions prior to 2026.2 represents a critical security flaw that allows remote attackers to execute arbitrary code through the Go Modules integration feature without requiring explicit project trust verification. The issue stems from insufficient validation of module dependencies during the import process, enabling malicious actors to inject harmful code into projects that would otherwise be considered safe. This vulnerability directly relates to CWE-494 which covers the acquisition of a malicious code module or library, and aligns with ATT&CK technique T1133 where adversaries establish persistence through code injection mechanisms.
The technical flaw exists in how GoLand handles module resolution and dependency management within its integrated development environment. When developers import modules from remote repositories, the IDE performs automatic downloads and integration without proper sandboxing or security checks that would normally occur after project trust is explicitly granted. This creates an attack surface where malicious actors can craft specially designed go.mod files or package metadata that triggers code execution during the module loading phase. The vulnerability specifically affects the automated dependency resolution process that occurs before users have confirmed they trust the source of the modules.
The operational impact of this vulnerability extends beyond simple code execution to potentially compromise entire development environments and infrastructure. Attackers can leverage this flaw to execute malicious code on developers' machines, potentially leading to data exfiltration, persistent backdoors, or further network infiltration through compromised development systems. Since GoLand is commonly used in enterprise environments where developers may have elevated privileges or access to sensitive projects, the potential for lateral movement and privilege escalation increases significantly. The vulnerability affects both individual developers and organizations that rely on GoLand for their Go programming workflows.
Mitigation strategies should focus on immediate upgrades to GoLand version 2026.2 or later where this vulnerability has been addressed through enhanced module validation and proper trust verification mechanisms. Organizations should also implement additional security controls including network segmentation, code review processes for dependency management, and monitoring for unusual module download patterns. Security teams should consider implementing automated tools that scan go.mod files for suspicious entries and establish policies requiring explicit approval of external dependencies before integration into development projects. Additionally, developers should be educated about the risks associated with importing untrusted modules and the importance of verifying source authenticity before accepting project trust prompts.