TOOLCHAIN · CVE-2026-97035 · Runtime
FIX → 1.27.4 +1
A Go package that uses cgo can smuggle Clang or GCC flags through #cgo directives, letting it write files to arbitrary directories or slip extra arguments into the linker during build. An attacker who gets a malicious package into a build gets code execution or file writes on the build machine.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams whose Go builds compile cgo code with Clang or GCC, especially when they pull in third-party packages that were not reviewed. Builds that never use cgo, or that only use trusted code and do not run dependency builds on shared machines, are less exposed. The sources do not say whether default configurations are affected beyond this.
Not affected if no-cgo, trusted-dependencies-only
Who cares build-servers, cgo, ci, go
go version and compare against the fixed versions.Upgrade to 1.27.4 +1
1.26.11 for the 1.26 line, 1.27.4 for the 1.27 line.When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-" or "-gnat" flags in "#cgo" directives.
The "-g*" wildcard in the compiler and linker flag allowlists previously matched Clang's two-argument "-gen-cdb-fragment-path <dir>" flag and GCC's two-argument "-gnatO <file>" flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker.
"-gen-" and "-gnat" flags are now disallowed in "#cgo" compiler and linker flags.
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.