CVE-2026-42503 Details

A vulnerability in the Go language server, gopls, allows for remote code execution. By default, gopls communicates through a pipe, but the -port and -listen flags can be used for debugging. If -listen is set to a value without an explicit host, or if -port is used, gopls will bind to 0.0.0.0. This unintended exposure can enable a malicious actor on the same network to execute arbitrary code via gopls.

Users can avoid this vulnerability by not using the -port or -listen flags, or by specifying an explicit host when using the -listen flag.