An untrusted Go SDK can be configured in JetBrains GoLand before the user grants project trust, enabling an attacker to execute arbitrary code on the host machine. The described vulnerability (CWE‑94) represents an improper control of code generation that can allow execution of malicious code, which compromises confidentiality, integrity, and availability of the system running the IDE.

JetBrains GoLand, any release prior to 2026.2. No specific patch level is listed, so all builds older than the 2026.2 milestone are potentially vulnerable.

The CVSS score of 7.8 indicates a high severity condition, while the EPSS score of less than 1 percent suggests that exploitation is considered unlikely but not impossible. The vulnerability is not yet catalogued in CISA’s KEV list, implying no known exploitation in the wild at the time of reporting. It is inferred that the attack vector would involve an attacker influencing the Go SDK configuration locally, most likely by providing a malicious SDK package and loading it into the IDE before user approval. Successful exploitation would allow arbitrary code execution within the context of the IDE process, thereby exposing the full privileges of the local user.