TOOLCHAIN · CVE-2026-97033 · Runtime
FIX → 1.27.4 +1
A Go package that uses cgo can pass certain compiler and linker flags in its #cgo directives that make the build run attacker-chosen code. Building or installing such a package can give the attacker code execution on the build machine.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that build Go code with the toolchain versions in the affected range, especially those who compile third-party packages that use cgo or who build untrusted code in CI. Projects that only build their own trusted code with cgo disabled are less exposed.
Not affected if cgo-disabled, patched-toolchain, trusted-sources-only
Who cares build-systems, cgo, ci, go
go version and compare against the fixed versions.Upgrade to 1.27.4 +1
1.26.11 on the 1.26 line or 1.27.4 on the 1.27 line.Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives.
Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; "-target" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and "-x" permitted specifying arbitrary compiler input languages beyond those supported by cgo.
"--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and "-Wl,-syslibroot" are verified not to point to regular files, and "-x" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.