gopls, when started with the –listen or –port flag without specifying a host, binds to the address 0.0.0.0. Because this binding exposes the development server on every network interface, an attacker on the same network can connect to the gopls instance and send arbitrary commands, allowing execution of code. This flaw is a classic example of CWE‑1327, where a service is exposed to unintended parties, resulting in full compromise of confidentiality, integrity, and availability.

golang.org/x/tools:gopls is the affected component. All current releases that support –listen or –port without a host parameter are vulnerable; vendor version details are not provided.

The vulnerability can be leveraged when a user runs gopls in debug mode on a shared or otherwise untrusted network. No public exploit has been reported and the EPSS score is currently unavailable, but the absence of a restriction on the bind address means the attack is straightforward once the conditions are met. The issue is not listed in the KEV catalog, yet the potential for arbitrary code execution warrants care. The CVSS score of 8.8 indicates a high severity level.