An attacker can achieve arbitrary code execution in the user’s environment by supplying an untrusted project configuration file to JetBrains GoLand. The weakness exploitable is a file path manipulation flaw that allows loading of external resources without proper validation, leading to remote code execution. The design flaw corresponds to CWE-73, Path Traversal.

The vulnerability impacts all versions of JetBrains GoLand earlier than 2026.1.3, regardless of platform. Users running older GoLand releases must verify that their installations are not below this version.

The CVSS score of 7.1 indicates high severity. No EPSS score is available, so exact exploitation likelihood is unknown, but the vulnerability is not listed in CISA’s KEV, implying it has not yet been widely exploited in the wild. The likely attack vector is a remote, client‑sourced configuration file that an attacker can place in a project directory, resulting in local code execution on the user's machine.