{"id":"CVE-2026-97033","kind":"vulnerability","aliases":["CVE-2026-97033","GO-2026-6858"],"related":[],"title":"Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go","description":"Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in \"#cgo\" directives.\n\nSpecifically, \"--sysroot\" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; \"-target\" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; \"-isysroot\" and \"-Wl,-syslibroot\" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and \"-x\" permitted specifying arbitrary compiler input languages beyond those supported by cgo.\n\n\"--sysroot\" and \"-target\" are now disallowed in \"#cgo\" flags, \"-isysroot\" and \"-Wl,-syslibroot\" are verified not to point to regular files, and \"-x\" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.","summary":"A Go package that uses cgo can pass certain compiler and linker flags in its #cgo directives that make the build run attacker-chosen code. Building or installing such a package can give the attacker code execution on the build machine.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"toolchain","fixed":["1.26.11","1.27.4"],"affected":">= 1.27.0-0, < 1.27.4","ecosystem":"go"}],"ecosystems":["go"],"tags":["build-systems","cgo","ci","go","runtime"],"not_affected_if":["cgo-disabled","patched-toolchain","trusted-sources-only"],"how_to_check":"- Run `go version` and compare against the fixed versions.\n- Check whether your build pipelines fetch and compile third-party packages that use cgo.","fix":"- Go toolchain: move to `1.26.11` on the 1.26 line or `1.27.4` on the 1.27 line.","status":"open","published_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:17+00:00","triaged_at":"2026-11-11T03:39:00+00:00","updated_at":"2026-11-11T03:39:00+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T03:39:00Z","model":"claude-haiku-5-5","output":{"fix":"- Go toolchain: move to `1.26.11` on the 1.26 line or `1.27.4` on the 1.27 line.","reach":"internet","title":"Go toolchain: malicious cgo package runs code at build time","impact":"high","summary":"A Go package that uses cgo can pass certain compiler and linker flags in its #cgo directives that make the build run attacker-chosen code. Building or installing such a package can give the attacker code execution on the build machine.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["go","cgo","ci","build-systems"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"code runs on the build machine during compilation","analyst_note":"unknown","how_to_check":"- Run `go version` and compare against the fixed versions.\n- Check whether your build pipelines fetch and compile third-party packages that use cgo.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["cgo-disabled","trusted-sources-only","patched-toolchain"],"who_is_affected":"Teams that build Go code with the toolchain versions in the affected range, especially those who compile third-party packages that use cgo or who build untrusted code in CI. Projects that only build their own trusted code with cgo disabled are less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4827,"output_tokens":488,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A,23A '-6858':21A '-97033':18A,24A 'arbitrari':84C,167C 'assembl':209C 'attack':56B,68B,118C 'attacker-chosen':55B 'attacker-control':117C 'back':125C 'beyond':171C 'build':27B,53B,59B,73B,75C,88C 'build-system':26B 'c':203C,204C,207C 'caus':83C 'certain':41B 'cgo':12A,29B,38B,48B,81C,98C,175C,183C,213C 'chosen':57B 'ci':30B 'clang':105C,123C 'cmd/go':15A 'code':2A,58B,69B,85C 'compil':42B,92C,107C,168C 'control':119C 'could':82C 'crt':112C 'current':133C 'cve':16A,22A 'direct':49B,99C 'directori':120C,135C 'disallow':181C 'disk':151C 'execut':3A,70B,86C,127C 'fall':124C 'file':110C,149C,196C 'flag':13A,45B,95C,184C 'found':138C 'gcc':103C 'give':66B 'gnu':153C 'go':19A,31B,34B 'helper':129C 'input':169C 'instal':61B 'interpret':156C 'isysroot':7A,141C,185C 'languag':170C,210C 'ld.bfd':154C 'linker':44B,94C,161C 'machin':74B 'make':51B 'malici':77C 'object':114C,206C 'objective-c':205C 'packag':35B,64B,78C 'pass':40B,146C 'path':140C 'permit':96C,165C 'point':193C 'posit':160C 'regular':148C,195C 'reloc':106C 'restrict':200C 'run':54B 'runtim':32B 'script':162C 'sever':91C 'spec':109C 'specif':100C 'specifi':166C 'startup':113C 'subprogram':108C 'support':173C,211C 'syslibroot':9A,144C,188C 'sysroot':5A,101C,176C 'system':28B 'target':6A,121C,128C,178C 'time':89C 'tool':130C 'toolchain':25A 'unexpect':1A 'use':37B,80C 'verifi':190C 'via':4A 'wl':8A,143C,187C 'work':134C 'x':11A,164C,198C","nicknames":[],"mitigations":[],"who_affected":"Teams that build Go code with the toolchain versions in the affected range, especially those who compile third-party packages that use cgo or who build untrusted code in CI. Projects that only build their own trusted code with cgo disabled are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["toolchain"],"ptokens":["toolchain"],"labels":["buildsystems","cgo","ci","go","high","runtime"],"campaign_type":null,"search_a":"'-2026':17A,20A,23A '-6858':21A '-97033':18A,24A 'cgo':12A 'cmd/go':15A 'code':2A 'cve':16A,22A 'execut':3A 'flag':13A 'go':19A 'isysroot':7A 'syslibroot':9A 'sysroot':5A 'target':6A 'toolchain':25A 'unexpect':1A 'via':4A 'wl':8A 'x':11A","search_b":"'attack':56B,68B 'attacker-chosen':55B 'build':27B,53B,59B,73B 'build-system':26B 'certain':41B 'cgo':29B,38B,48B 'chosen':57B 'ci':30B 'code':58B,69B 'compil':42B 'direct':49B 'execut':70B 'flag':45B 'give':66B 'go':31B,34B 'instal':61B 'linker':44B 'machin':74B 'make':51B 'packag':35B,64B 'pass':40B 'run':54B 'runtim':32B 'system':28B 'use':37B","search_c":"'arbitrari':84C,167C 'assembl':209C 'attack':118C 'attacker-control':117C 'back':125C 'beyond':171C 'build':75C,88C 'c':203C,204C,207C 'caus':83C 'cgo':81C,98C,175C,183C,213C 'clang':105C,123C 'code':85C 'compil':92C,107C,168C 'control':119C 'could':82C 'crt':112C 'current':133C 'direct':99C 'directori':120C,135C 'disallow':181C 'disk':151C 'execut':86C,127C 'fall':124C 'file':110C,149C,196C 'flag':95C,184C 'found':138C 'gcc':103C 'gnu':153C 'helper':129C 'input':169C 'interpret':156C 'isysroot':141C,185C 'languag':170C,210C 'ld.bfd':154C 'linker':94C,161C 'malici':77C 'object':114C,206C 'objective-c':205C 'packag':78C 'pass':146C 'path':140C 'permit':96C,165C 'point':193C 'posit':160C 'regular':148C,195C 'reloc':106C 'restrict':200C 'script':162C 'sever':91C 'spec':109C 'specif':100C 'specifi':166C 'startup':113C 'subprogram':108C 'support':173C,211C 'syslibroot':144C,188C 'sysroot':101C,176C 'target':121C,128C,178C 'time':89C 'tool':130C 'use':80C 'verifi':190C 'wl':143C,187C 'work':134C 'x':164C,198C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T02:51:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6858","url":"https://pkg.go.dev/vuln/GO-2026-6858","severity":null,"published_at":"2026-11-11T02:51:11+00:00","modified_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:17+00:00","fetched_at":"2026-11-11T03:37:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}