A vulnerability in Golang gopls allows unauthenticated adjacent network attackers to execute arbitrary code via insecure socket binding, posing a critical risk to development environments.

This issue is caused by binding to an unrestricted IP address (CWE-1327) through the improper use of debugging flags such as port or listen. An unauthenticated attacker on the same network can trigger this vulnerability with low complexity and no user interaction.

A successful exploit allows an unauthorized malicious party on the same network to achieve arbitrary code execution on the developer workstation or server running the affected language server. This can lead to total system compromise, data theft, or lateral movement within the internal network. The high CVSS score of 8.8 reflects the severity of potential total technical impact and system compromise.

Immediate Action: Update golang.org/x/tools/gopls to version 0.22.0 or later to resolve the unrestricted binding behavior.

Proactive Monitoring: Monitor network traffic for unexpected inbound connections on debugging ports associated with gopls instances.

Compensating Controls: Ensure host-based firewalls restrict access to debugging ports and avoid using the port or listen flags without explicitly binding to localhost.

Public Exploit Available: No (no confirmed public exploit available in the current intelligence data).

Security teams and developers must prioritize updating gopls to the patched version immediately. Review development configurations to ensure debugging services do not unintentionally listen on all network interfaces.