This vulnerability allows an attacker to execute arbitrary code on the local machine by exploiting the Go Modules integration in JetBrains GoLand. It is triggered before the user grants project trust to a module; an attacker can supply malicious code that will be executed with the user's privileges. The flaw is a classic code injection weakness (CWE-94).

JetBrains GoLand versions older than 2026.2 are affected, as the issue only exists in releases before the 2026.2 release. No specific sub‑version ranges were identified, so any install of GoLand before that release is potentially vulnerable.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of < 1% suggests the attack probability is low at this time. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is local; an attacker would need to supply a malicious module or otherwise manipulate the Go Modules trust prompt, which usually requires user interaction or trust from a code repository. The impact is full compromise of the host if exploitation succeeds.