CVE-2026-53915: GoLand Remote Code Execution via Untrusted Project Configuration

Technical summary

The vulnerability stems from insufficient validation of project configuration files (CWE-73: External Control of File Name or Path). When GoLand parses and processes project configuration data, it does not adequately sandbox or restrict the execution context. An attacker-controlled project configuration can specify execution directives—such as build scripts, run configurations, or plugin definitions—that bypass normal code review and directly execute on the developer's system. The attack vector is network-accessible (AV:N), requires no authentication (PR:N), and relies on user interaction limited to opening a project (UI:R), which is a routine developer workflow. The impact spans confidentiality, integrity, and availability, with potential lateral movement into the development environment or supply chain.

Business impact

A compromised developer machine can expose source code repositories, credentials stored in IDE memory or configuration files, API keys, and internal development infrastructure. In supply chain contexts, malicious code injected through a poisoned project configuration could propagate into builds and releases. Teams using shared repositories or onboarding new developers from external sources face elevated risk. The severity is heightened because developers often work with code from multiple origins and may not scrutinize project configuration syntax in the same way they review application source code.

Affected systems

JetBrains GoLand versions prior to 2026.1.3 are affected. This includes all earlier versions in the 2026.x line and earlier major versions. The scope is limited to GoLand; other JetBrains IDEs (IntelliJ IDEA, WebStorm, etc.) may have separate patches. Verify your installed version via Help > About GoLand and confirm the build number against the official advisory.

Exploitability

Exploitability is moderately high. An attacker must socially engineer a developer to open a malicious project—either by hosting it on a public repository, including it in a dependency, or submitting it as a pull request. No special tools or knowledge are required; the attack requires only crafting a valid project configuration file. The CVSS score of 7.1 (HIGH) reflects the combination of network accessibility and the routine nature of opening projects in an IDE. Active exploitation in the wild has not been confirmed in the official KEV catalog, though the attack pattern is straightforward enough that cautious defenders should assume eventual weaponization.

Remediation

Update GoLand to version 2026.1.3 or later immediately. Before patching, adopt a defensive posture: avoid opening projects from untrusted sources, review project configuration files (.idea/ directory contents, IDE-specific config files) before opening projects, and consider restricting which developers can clone and run arbitrary projects. For teams managing shared development environments, consider using containerized or sandboxed development workspaces to limit the blast radius of IDE compromise.

Patch guidance

JetBrains releases patches through the standard IDE update mechanism. Navigate to Help > Check for Updates in GoLand and apply version 2026.1.3 or any later release. Verify the patch installation by checking Help > About GoLand and confirming the build number matches or exceeds the fixed version. If you use a JetBrains license server or offline updates, coordinate with your IT team to ensure the patched version is available in your deployment pipeline. No interim workarounds exist; patching is the only reliable mitigation.

Detection guidance

Monitor for unusual process spawning or network connections originating from GoLand processes, especially when developers open new or unfamiliar projects. Log file integrity monitoring on the .idea/ directory and IDE configuration folders can surface suspicious modifications. In endpoint detection and response (EDR) solutions, flag child processes launched by GoLand's JVM with unexpected command-line arguments or unusual parents. Inspect project configuration files in version control for unexpected build scripts, shell commands, or external tool integrations that do not align with team standards.

Why prioritize this

This vulnerability merits immediate attention because it directly threatens developer machines, which are high-value targets for attackers seeking code access, credentials, and supply chain leverage. The network attack vector and ease of exploitation (social engineering) lower the barrier to attack. Although KEV tracking has not flagged active exploitation, the simplicity of the exploit pattern means defenders should treat this as a priority-1 issue and patch within days, not weeks. Organizations with strict code review processes or sandboxed development environments may deprioritize slightly, but patching should remain urgent.

Risk score, explained

The CVSS v3.1 score of 7.1 (HIGH) balances a network-accessible, unauthenticated attack vector against the requirement for user interaction (opening a project). The scope is marked as 'changed' (C in the vector), indicating potential impact beyond the vulnerable component, reflecting the risk that a compromised IDE could access development infrastructure and credentials. The confidentiality, integrity, and availability impacts are all marked as low (L), which reflects the sandbox limitations of the JVM; however, in practice, developer machines are not air-gapped, making this a conservative assessment. The HIGH severity is justified and should drive immediate patching decisions.

Frequently asked questions