{"id":"CVE-2026-97034","kind":"vulnerability","aliases":["CVE-2026-97034","GO-2026-6857"],"related":[],"title":"Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go","description":"When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files (\"specs\" or \"*.spec\").\n\nWhen linking with \"-fopenmp\", \"-fopenacc\", or \"-fsanitize=\" in \"#cgo LDFLAGS\", GCC's built-in link spec evaluates \"%:include(libgomp.spec)\" or \"%:include(libsanitizer.spec)\" and searches for spec files in \"-L\" and sysroot directories (including subdirectories and multilib sibling directories such as \"../lib64\"), as well as the working directory when \"-fopenmp\" or \"-fopenacc\" is used or when \"-fsanitize=\" is combined with \"-static\" or \"-static-lib*\".\n\nThe go command now rejects \"-L\", \"-isysroot\", and \"-Wl,-syslibroot\" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows \"@\" and \"-\" prefixes in \"-fsanitize=\" compiler flag values.","summary":"A malicious Go package that uses cgo can make GCC load an untrusted spec file during linking, which runs attacker-chosen commands on the build machine. The risk is at build time, when a team compiles code that pulls in a hostile cgo package.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"toolchain","fixed":["1.26.11","1.27.4"],"affected":">= 1.27.0-0, < 1.27.4","ecosystem":"go"}],"ecosystems":["go"],"tags":["build-servers","cgo","ci","gcc","go","package"],"not_affected_if":["cgo-disabled","clang-toolchain","no-untrusted-cgo-packages"],"how_to_check":"- Run `go version` and compare against the fixed releases.\n- Check whether builds use cgo (`CGO_ENABLED=1`) with GCC and link flags containing `-fopenmp`, `-fopenacc` or `-fsanitize=`.\n- Review third-party cgo dependencies in `go.mod`.","fix":"- Go `1.26.11`\n- Go `1.27.4`","status":"open","published_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:17+00:00","triaged_at":"2026-11-11T03:39:00+00:00","updated_at":"2026-11-11T03:39:00+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T03:39:00Z","model":"claude-haiku-5-5","output":{"fix":"- Go `1.26.11`\n- Go `1.27.4`","reach":"local","title":"Go toolchain: cgo builds can run commands via GCC spec files","impact":"high","summary":"A malicious Go package that uses cgo can make GCC load an untrusted spec file during linking, which runs attacker-chosen commands on the build machine. The risk is at build time, when a team compiles code that pulls in a hostile cgo package.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","cgo","gcc","ci","build-servers"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Arbitrary commands run on the build machine during linking","analyst_note":"","how_to_check":"- Run `go version` and compare against the fixed releases.\n- Check whether builds use cgo (`CGO_ENABLED=1`) with GCC and link flags containing `-fopenmp`, `-fopenacc` or `-fsanitize=`.\n- Review third-party cgo dependencies in `go.mod`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["cgo-disabled","clang-toolchain","no-untrusted-cgo-packages"],"who_is_affected":"Teams that build Go code with cgo on GCC, especially when they compile third-party packages that use cgo with -fopenmp, -fopenacc or -fsanitize= link flags. Pure Go builds with CGO disabled are not exposed through this path. Teams on Go 1.26.x before 1.26.11 or 1.27.x before 1.27.4 are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000786,"input_tokens":4819,"output_tokens":608,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A,22A '-6857':20A '-97034':17A,23A '/lib64':145C 'applic':187C 'arbitrari':1A,90C 'attack':53B 'attacker-chosen':52B 'build':26B,58B,64B,81C 'build-serv':25B 'built':117C 'built-in':116C 'caus':89C 'cgo':9A,28B,39B,76B,87C,112C 'chosen':54B 'ci':29B 'cmd/go':14A 'code':70B 'combin':162C 'command':2A,55B,91C,171C 'compil':69B,199C 'contain':189C 'could':88C 'cve':15A,21A 'directori':12A,136C,142C,151C,179C,185C 'disallow':194C 'evalu':121C 'execut':3A,92C 'file':7A,47B,100C,131C,192C 'flag':200C 'fopenacc':108C,155C 'fopenmp':107C,153C 'fsanit':110C,160C,198C 'gcc':5A,30B,42B,80C,98C,114C,190C 'go':18A,31B,35B,170C 'hostil':75B 'includ':122C,125C,137C 'isysroot':175C 'l':133C,174C 'ldflag':113C 'lib':168C 'libgomp.spec':123C 'libsanitizer.spec':126C 'link':49B,94C,105C,119C 'linker':10A 'load':43B 'machin':59B 'make':41B 'malici':34B,83C 'multilib':140C 'packag':32B,36B,77B,84C,184C 'prefix':196C 'pull':72B 'reject':173C 'risk':61B 'run':51B 'search':11A,128C 'server':27B 'sibl':141C 'spec':6A,46B,99C,101C,103C,120C,130C,191C 'static':164C,167C 'static-lib':166C 'subdirectori':138C 'syslibroot':178C 'sysroot':135C 'team':68B 'time':65B,95C 'toolchain':24A 'untrust':45B,97C 'use':38B,79C,86C,157C 'valu':201C 'via':4A,96C 'well':147C 'wl':177C 'work':150C,182C","nicknames":[],"mitigations":[],"who_affected":"Teams that build Go code with cgo on GCC, especially when they compile third-party packages that use cgo with -fopenmp, -fopenacc or -fsanitize= link flags. Pure Go builds with CGO disabled are not exposed through this path. Teams on Go 1.26.x before 1.26.11 or 1.27.x before 1.27.4 are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["toolchain"],"ptokens":["toolchain"],"labels":["buildservers","cgo","ci","gcc","go","high","package"],"campaign_type":null,"search_a":"'-2026':16A,19A,22A '-6857':20A '-97034':17A,23A 'arbitrari':1A 'cgo':9A 'cmd/go':14A 'command':2A 'cve':15A,21A 'directori':12A 'execut':3A 'file':7A 'gcc':5A 'go':18A 'linker':10A 'search':11A 'spec':6A 'toolchain':24A 'via':4A","search_b":"'attack':53B 'attacker-chosen':52B 'build':26B,58B,64B 'build-serv':25B 'cgo':28B,39B,76B 'chosen':54B 'ci':29B 'code':70B 'command':55B 'compil':69B 'file':47B 'gcc':30B,42B 'go':31B,35B 'hostil':75B 'link':49B 'load':43B 'machin':59B 'make':41B 'malici':34B 'packag':32B,36B,77B 'pull':72B 'risk':61B 'run':51B 'server':27B 'spec':46B 'team':68B 'time':65B 'untrust':45B 'use':38B","search_c":"'/lib64':145C 'applic':187C 'arbitrari':90C 'build':81C 'built':117C 'built-in':116C 'caus':89C 'cgo':87C,112C 'combin':162C 'command':91C,171C 'compil':199C 'contain':189C 'could':88C 'directori':136C,142C,151C,179C,185C 'disallow':194C 'evalu':121C 'execut':92C 'file':100C,131C,192C 'flag':200C 'fopenacc':108C,155C 'fopenmp':107C,153C 'fsanit':110C,160C,198C 'gcc':80C,98C,114C,190C 'go':170C 'includ':122C,125C,137C 'isysroot':175C 'l':133C,174C 'ldflag':113C 'lib':168C 'libgomp.spec':123C 'libsanitizer.spec':126C 'link':94C,105C,119C 'malici':83C 'multilib':140C 'packag':84C,184C 'prefix':196C 'reject':173C 'search':128C 'sibl':141C 'spec':99C,101C,103C,120C,130C,191C 'static':164C,167C 'static-lib':166C 'subdirectori':138C 'syslibroot':178C 'sysroot':135C 'time':95C 'untrust':97C 'use':79C,86C,157C 'valu':201C 'via':96C 'well':147C 'wl':177C 'work':150C,182C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T02:51:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6857","url":"https://pkg.go.dev/vuln/GO-2026-6857","severity":null,"published_at":"2026-11-11T02:51:11+00:00","modified_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:17+00:00","fetched_at":"2026-11-11T03:37:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}