TOOLCHAIN · CVE-2026-97036 · Runtime
FIX → 1.27.4 +1
A malicious Go package that uses cgo can make the macOS linker load an attacker-supplied dynamic library during the build, because a `#cgo LDFLAGS` directive passes `-l to_library` which the Apple linker merges into `-lto_library`. The build machine then runs arbitrary code.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that build Go programs on macOS with the Go toolchain in the affected range, especially when they compile third-party packages that use cgo. Builds on Linux or Windows, or builds that never compile untrusted cgo code, are not exposed through this flaw. The risk comes from the build step, not from the program that is shipped.
Not affected if linux-build, no-cgo, trusted-dependencies-only, windows-build
Who cares cgo, ci, go, macos
go version on build machines and CI runners and compare against the fixed versions.import "C").#cgo LDFLAGS directives containing to_library.Upgrade to 1.27.4 +1
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive.
The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time.
The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.26.111.27.4