TOOLCHAIN · CVE-2026-97037 · Runtime
FIX → 1.27.4 +1
Go's cgo support passed certain split -Wl, linker flags to the host linker in a way that let a malicious package supply a linker script. Building that package can run arbitrary code on the build machine.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that build Go programs with cgo enabled, including CI runners, and that pull in third-party packages containing cgo directives. The flaw is triggered when a package's #cgo LDFLAGS are processed during the build. Teams that build only pure-Go code or only trusted cgo code can skip it.
Not affected if cgo-disabled, pure-go-code, trusted-packages-only
Who cares cgo, ci-builds, go
go version on build machines and CI runners to see the installed toolchain.CGO_ENABLED=1) from packages you do not fully trust.Upgrade to 1.27.4 +1
1.27.4.1.26.11.Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS".
Split "-Wl," flags that consume a following argument (such as "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined") previously accepted a bare second argument without a "-Wl," prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as "-framework", "-Wl,-framework", "-Wl,-undefined", "-Wl,--just-symbols", "-Wl,-R", "-Wl,-subsystem", and (on non-Darwin platforms) "-Wl,-sectcreate" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk.
The go command now requires a "-Wl," prefix on the second token of split "-Wl," flags (except "-Wl,-R"), verifies that these flags do not reference linker script files, and disallows bare "-Wl,--warn-backrefs-exclude".
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.