JetBrains Vulnerabilities and Affected Products
Vulnerabilities associated with GoLand.
Products
Clear product- TeamCity183 vulnerabilities
- YouTrack62 vulnerabilities
- IntelliJ IDEA49 vulnerabilities
- Hub16 vulnerabilities
- Ktor10 vulnerabilities
- GoLand6 vulnerabilities
- Rider6 vulnerabilities
- Toolbox App6 vulnerabilities
- WebStorm6 vulnerabilities
- PyCharm5 vulnerabilities
- PhpStorm4 vulnerabilities
- Junie3 vulnerabilities
- ReSharper2 vulnerabilities
- RubyMine2 vulnerabilities
- Aqua1 vulnerability
- CLion1 vulnerability
- DataGrip1 vulnerability
- Datalore1 vulnerability
- DataSpell1 vulnerability
- dotTrace1 vulnerability
- ETW Host Service1 vulnerability
- IDE Services1 vulnerability
- intellij_idea1 vulnerability
- JetBrains Gateway1 vulnerability
- Kotlin1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-64803HIGH | Generated title:JetBrains GoLand Code Injection via Configured Go SDKIn JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK CWE-94Jul 23, 2026 | CVSS7.8v3.1 | EPSS0.143% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-64802HIGH | Generated title:JetBrains GoLand Go Modules Integration Code InjectionIn JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration CWE-94Jul 23, 2026 | CVSS7.8v3.1 | EPSS0.143% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Generated title:JetBrains GoLand Sensitive Configuration Information Disclosure in Log FilesIn JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default CWE-532Jul 23, 2026 | CVSS3.5v3.1 | EPSS0.491% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2026-53915HIGH | Generated title:JetBrains GoLand Remote Code Execution via Untrusted Project ConfigurationIn JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration CWE-73Jun 19, 2026 | CVSS7.1v3.1 | EPSS0.288% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-29932MEDIUM | In JetBrains GoLand before 2025.1 an XXE during debugging was possible CWE-611Mar 25, 2025 | CVSS4.1v3.1 | EPSS0.171% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-37051CRITICAL | GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; Aqua 2024.1.2; CLion 2023.1.7, 2023.2.4, 2023.3.5, 2024.1.3, 2024.2 EAP2; DataGrip 2023.1.3, 2023.2.4, 2023.3.5, 2024.1.4; DataSpell 2023.1.6, 2023.2.7, 2023.3.6, 2024.1.2, 2024.2 EAP1; GoLand 2023.1.6, 2023.2.7, 2023.3.7, 2024.1.3, 2024.2 EAP3; MPS 2023.2.1, 2023.3.1, 2024.1 EAP2; PhpStorm 2023.1.6, 2023.2.6, 2023.3.7,… CWE-522Jun 10, 2024 | CVSS9.3v3.1 | EPSS3.84% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |