gopls CVE-2026-42503

Exploitation requires the developer to manually invoke gopls with specific non-default debugging flags: either -listen flag with a value lacking explicit host specification (e.g., -listen=:8080 instead of -listen=127.0.0.1:8080) or -port flag in any usage. The developer and attacker must be on the same adjacent network segment (AV:A) such as shared WiFi, corporate LAN, or cloud VPC. Normal gopls operation using default pipe-based IPC is not vulnerable - only network-enabled debugging configurations expose the attack surface. Limiting factors: not exploitable against default gopls installations, requires developer to be using debugging features, and attack surface exists only while gopls process is running with network flags enabled. Adjacent network requirement prevents internet-wide exploitation but does not protect against attacks from compromised systems on the same network segment or malicious insiders.

CVSS 8.8 (High) reflects unauthenticated remote code execution but the Adjacent Network (AV:A) vector significantly constrains real-world exploitability compared to internet-reachable vulnerabilities. Attack complexity is Low (AC:L) with no privileges required (PR:N) and no user interaction (UI:N), meaning exploitation is trivial once the preconditions are met. However, the exploitation conditions are highly specific: developers must manually invoke gopls with debugging flags in non-default configurations, AND be on a shared untrusted network. This is not a default-configuration vulnerability affecting production systems but rather a developer tooling misconfiguration risk. The high confidentiality, integrity, and availability impact (C:H/I:H/A:H) reflects that successful exploitation grants arbitrary code execution with the privileges of the developer's IDE process, potentially accessing source code, credentials, and development infrastructure. No CISA KEV listing indicates this is not being actively exploited at scale despite the straightforward attack vector. Real-world priority is Medium for organizations with developers working from untrusted networks (remote work, conferences, co-working spaces) but Low for isolated development environments. CRITICAL GAP: EPSS score not available, POC status uncertain from provided references - fix availability confirmed via Go change list CL/774381 but exact patched version not specified in available data.

A developer working from a coffee shop runs gopls with 'gopls -listen=:8080' to debug IDE integration issues, inadvertently binding to 0.0.0.0. An attacker on the same WiFi network scans for open ports, discovers port 8080 running gopls, and sends Language Server Protocol (LSP) requests to execute arbitrary Go code through gopls's code execution capabilities. The attacker gains code execution with the developer's privileges, accessing source code repositories, API keys in environment variables, and potentially pivoting to connected development infrastructure.