{"id":"CVE-2026-97036","kind":"vulnerability","aliases":["CVE-2026-97036","GO-2026-6855"],"related":[],"title":"Arbitrary code execution during build on darwin via \"-l to_library\" in cgo in cmd/go","description":"On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing \"-l to_library <path>\" in a \"#cgo LDFLAGS\" directive.\n\nThe Apple linker recombines the separated arguments \"-l\" and \"to_library\" into \"-lto_library\", which loads an arbitrary LTO plugin dynamic library at link time.\n\nThe go command now disallows \"-l\" followed by \"to_library\" in \"#cgo LDFLAGS\", rejects \"-lazy_library\", \"-lazy_framework\", \"-load_hidden\", \"-library\", and \"-library-path\", and checks recombined \"-l\" arguments against disallowed linker flags and patterns.","summary":"A malicious Go package that uses cgo can make the macOS linker load an attacker-supplied dynamic library during the build, because a `#cgo LDFLAGS` directive passes `-l to_library` which the Apple linker merges into `-lto_library`. The build machine then runs arbitrary code.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"toolchain","fixed":["1.26.11","1.27.4"],"affected":">= 1.27.0-0, < 1.27.4","ecosystem":"go"}],"ecosystems":["go"],"tags":["cgo","ci","go","macos","runtime"],"not_affected_if":["linux-build","no-cgo","trusted-dependencies-only","windows-build"],"how_to_check":"- Run `go version` on build machines and CI runners and compare against the fixed versions.\n- Check whether builds on macOS compile third-party packages that use cgo (`import \"C\"`).\n- Search dependencies for `#cgo LDFLAGS` directives containing `to_library`.","fix":"- Go `1.26.11`\n- Go `1.27.4`","status":"open","published_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:17+00:00","triaged_at":"2026-11-11T03:38:56+00:00","updated_at":"2026-11-11T03:38:56+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-11T03:38:56Z","model":"claude-haiku-5-5","output":{"fix":"- Go `1.26.11`\n- Go `1.27.4`","reach":"local","title":"Go toolchain: building a cgo package on macOS can run attacker code","impact":"high","summary":"A malicious Go package that uses cgo can make the macOS linker load an attacker-supplied dynamic library during the build, because a `#cgo LDFLAGS` directive passes `-l to_library` which the Apple linker merges into `-lto_library`. The build machine then runs arbitrary code.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["go","macos","cgo","ci"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Arbitrary code runs on the macOS build machine during compilation","analyst_note":"","how_to_check":"- Run `go version` on build machines and CI runners and compare against the fixed versions.\n- Check whether builds on macOS compile third-party packages that use cgo (`import \"C\"`).\n- Search dependencies for `#cgo LDFLAGS` directives containing `to_library`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["linux-build","windows-build","no-cgo","trusted-dependencies-only"],"who_is_affected":"Teams that build Go programs on macOS with the Go toolchain in the affected range, especially when they compile third-party packages that use cgo. Builds on Linux or Windows, or builds that never compile untrusted cgo code, are not exposed through this flaw. The risk comes from the build step, not from the program that is shipped.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000761,"input_tokens":4714,"output_tokens":580,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A,23A '-6855':21A '-97036':18A,24A 'appl':64B,94C,108C 'arbitrari':1A,75B,88C,124C 'argument':113C,161C 'attack':46B 'attacker-suppli':45B 'build':5A,52B,71B,79C 'caus':87C 'cgo':13A,26B,37B,55B,85C,104C,143C 'check':158C 'ci':27B 'cmd/go':15A 'code':2A,76B,89C 'command':134C 'could':86C 'cve':16A,22A 'darwin':7A,78C 'direct':57B,106C 'disallow':136C,163C 'due':96C 'dynam':48B,127C 'execut':3A,90C 'flag':165C 'follow':138C 'framework':149C 'go':19A,28B,33B,133C 'hidden':151C 'l':9A,59B,99C,114C,137C,160C 'lazi':146C,148C 'ldflag':56B,105C,144C 'librari':11A,49B,61B,69B,101C,117C,120C,128C,141C,147C,152C,155C 'library-path':154C 'link':130C 'linker':42B,65B,95C,109C,164C 'load':43B,122C,150C 'lto':68B,119C,125C 'machin':72B 'maco':29B,41B 'make':39B 'malici':32B,81C 'merg':66B 'packag':34B,82C 'pass':58B,98C 'path':156C 'pattern':167C 'plugin':126C 'recombin':110C,159C 'reject':145C 'run':74B 'runtim':30B 'separ':112C 'suppli':47B 'time':131C 'toolchain':25A 'use':36B,84C,92C 'via':8A","nicknames":[],"mitigations":[],"who_affected":"Teams that build Go programs on macOS with the Go toolchain in the affected range, especially when they compile third-party packages that use cgo. Builds on Linux or Windows, or builds that never compile untrusted cgo code, are not exposed through this flaw. The risk comes from the build step, not from the program that is shipped.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["toolchain"],"ptokens":["toolchain"],"labels":["cgo","ci","go","high","macos","runtime"],"campaign_type":null,"search_a":"'-2026':17A,20A,23A '-6855':21A '-97036':18A,24A 'arbitrari':1A 'build':5A 'cgo':13A 'cmd/go':15A 'code':2A 'cve':16A,22A 'darwin':7A 'execut':3A 'go':19A 'l':9A 'librari':11A 'toolchain':25A 'via':8A","search_b":"'appl':64B 'arbitrari':75B 'attack':46B 'attacker-suppli':45B 'build':52B,71B 'cgo':26B,37B,55B 'ci':27B 'code':76B 'direct':57B 'dynam':48B 'go':28B,33B 'l':59B 'ldflag':56B 'librari':49B,61B,69B 'linker':42B,65B 'load':43B 'lto':68B 'machin':72B 'maco':29B,41B 'make':39B 'malici':32B 'merg':66B 'packag':34B 'pass':58B 'run':74B 'runtim':30B 'suppli':47B 'use':36B","search_c":"'appl':94C,108C 'arbitrari':88C,124C 'argument':113C,161C 'build':79C 'caus':87C 'cgo':85C,104C,143C 'check':158C 'code':89C 'command':134C 'could':86C 'darwin':78C 'direct':106C 'disallow':136C,163C 'due':96C 'dynam':127C 'execut':90C 'flag':165C 'follow':138C 'framework':149C 'go':133C 'hidden':151C 'l':99C,114C,137C,160C 'lazi':146C,148C 'ldflag':105C,144C 'librari':101C,117C,120C,128C,141C,147C,152C,155C 'library-path':154C 'link':130C 'linker':95C,109C,164C 'load':122C,150C 'lto':119C,125C 'malici':81C 'packag':82C 'pass':98C 'path':156C 'pattern':167C 'plugin':126C 'recombin':110C,159C 'reject':145C 'separ':112C 'time':131C 'use':84C,92C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T02:51:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6855","url":"https://pkg.go.dev/vuln/GO-2026-6855","severity":null,"published_at":"2026-11-11T02:51:11+00:00","modified_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:17+00:00","fetched_at":"2026-11-11T03:37:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}