---
id: "CVE-2026-97035"
page: "https://infrastack.ai/live/CVE-2026-97035"
kind: "vulnerability"
aliases: ["CVE-2026-97035", "GO-2026-6856"]
title: "Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "toolchain", "fixed": ["1.26.11", "1.27.4"], "affected": ">= 1.27.0-0, < 1.27.4", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["build-servers", "cgo", "ci", "go", "runtime"]
not_affected_if: ["no-cgo", "trusted-dependencies-only"]
published_at: "2026-11-11T02:51:11+00:00"
first_seen_at: "2026-11-11T03:37:17+00:00"
updated_at: "2026-11-11T03:38:59+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6856", "first_seen_at": "2026-11-11T03:37:17+00:00"}]
exploit_sources: []
---

# Unexpected code execution and arbitrary file write via Clang -gen-* and GCC -gnat* flags in cgo in cmd/go

Link for people: https://infrastack.ai/live/CVE-2026-97035 (this .md is for agents)

A Go package that uses cgo can smuggle Clang or GCC flags through #cgo directives, letting it write files to arbitrary directories or slip extra arguments into the linker during build. An attacker who gets a malicious package into a build gets code execution or file writes on the build machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:toolchain affected >= 1.27.0-0, < 1.27.4 fixed 1.26.11, 1.27.4

## How to check

- Run `go version` and compare against the fixed versions.
- Check whether builds compile cgo packages from untrusted or third-party sources.

## Fix

- Go toolchain: `1.26.11` for the 1.26 line, `1.27.4` for the 1.27 line.

## Timeline

- 2026-11-11T03:37:17+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6856

## From the sources

When using Clang or GCC, building a malicious package that uses cgo could cause unexpected code execution at build time or write files to arbitrary directories via "-gen-*" or "-gnat*" flags in "#cgo" directives.

The "-g*" wildcard in the compiler and linker flag allowlists previously matched Clang's two-argument "-gen-cdb-fragment-path <dir>" flag and GCC's two-argument "-gnatO <file>" flag, permitting compilation database fragments and sidecar output files to be written to arbitrary directories and desynchronizing flag argument parsing between the go command and the compiler driver so that subsequent arguments could be passed as unvalidated positional inputs to the linker.

"-gen-*" and "-gnat*" flags are now disallowed in "#cgo" compiler and linker flags.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_