---
id: "CVE-2026-97036"
page: "https://infrastack.ai/live/CVE-2026-97036"
kind: "vulnerability"
aliases: ["CVE-2026-97036", "GO-2026-6855"]
title: "Arbitrary code execution during build on darwin via \"-l to_library\" in cgo in cmd/go"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "toolchain", "fixed": ["1.26.11", "1.27.4"], "affected": ">= 1.27.0-0, < 1.27.4", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cgo", "ci", "go", "macos", "runtime"]
not_affected_if: ["linux-build", "no-cgo", "trusted-dependencies-only", "windows-build"]
published_at: "2026-11-11T02:51:11+00:00"
first_seen_at: "2026-11-11T03:37:17+00:00"
updated_at: "2026-11-11T03:38:56+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6855", "first_seen_at": "2026-11-11T03:37:17+00:00"}]
exploit_sources: []
---

# Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

Link for people: https://infrastack.ai/live/CVE-2026-97036 (this .md is for agents)

A malicious Go package that uses cgo can make the macOS linker load an attacker-supplied dynamic library during the build, because a `#cgo LDFLAGS` directive passes `-l to_library` which the Apple linker merges into `-lto_library`. The build machine then runs arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:toolchain affected >= 1.27.0-0, < 1.27.4 fixed 1.26.11, 1.27.4

## How to check

- Run `go version` on build machines and CI runners and compare against the fixed versions.
- Check whether builds on macOS compile third-party packages that use cgo (`import "C"`).
- Search dependencies for `#cgo LDFLAGS` directives containing `to_library`.

## Fix

- Go `1.26.11`
- Go `1.27.4`

## Timeline

- 2026-11-11T03:37:17+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6855

## From the sources

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive.

The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time.

The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_