{"id":"CVE-2026-97037","kind":"vulnerability","aliases":["CVE-2026-97037","GO-2026-6854"],"related":[],"title":"Linker script injection via split -Wl, flags and Darwin or symbol linker flags in cgo in cmd/go","description":"Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via \"#cgo LDFLAGS\".\n\nSplit \"-Wl,\" flags that consume a following argument (such as \"-Wl,-rpath\", \"-Wl,--just-symbols\", and \"-Wl,-undefined\") previously accepted a bare second argument without a \"-Wl,\" prefix, which the compiler driver passes directly to the linker as a positional input file. Additionally, when using GNU ld.bfd, flags such as \"-framework\", \"-Wl,-framework\", \"-Wl,-undefined\", \"-Wl,--just-symbols\", \"-Wl,-R\", \"-Wl,-subsystem\", and (on non-Darwin platforms) \"-Wl,-sectcreate\" could cause ld.bfd to interpret their arguments as linker scripts if they named a regular file on disk.\n\nThe go command now requires a \"-Wl,\" prefix on the second token of split \"-Wl,\" flags (except \"-Wl,-R\"), verifies that these flags do not reference linker script files, and disallows bare \"-Wl,--warn-backrefs-exclude\".","summary":"Go's cgo support passed certain split -Wl, linker flags to the host linker in a way that let a malicious package supply a linker script. Building that package can run arbitrary code on the build machine.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"toolchain","fixed":["1.26.11","1.27.4"],"affected":">= 1.27.0-0, < 1.27.4","ecosystem":"go"}],"ecosystems":["go"],"tags":["cgo","ci-builds","go","runtime"],"not_affected_if":["cgo-disabled","pure-go-code","trusted-packages-only"],"how_to_check":"- Run `go version` on build machines and CI runners to see the installed toolchain.\n- Check whether builds compile cgo code (`CGO_ENABLED=1`) from packages you do not fully trust.","fix":"- Go 1.27 line: upgrade to `1.27.4`.\n- Go 1.26 line: upgrade to `1.26.11`.","status":"open","published_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:17+00:00","triaged_at":"2026-11-11T03:38:59+00:00","updated_at":"2026-11-11T03:38:59+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-11T03:38:59Z","model":"claude-haiku-5-5","output":{"fix":"- Go 1.27 line: upgrade to `1.27.4`.\n- Go 1.26 line: upgrade to `1.26.11`.","reach":"local","title":"Go toolchain: cgo link flags could run code at build time","impact":"high","summary":"Go's cgo support passed certain split -Wl, linker flags to the host linker in a way that let a malicious package supply a linker script. Building that package can run arbitrary code on the build machine.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["go","cgo","ci-builds"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Arbitrary code runs on the build machine during linking.","analyst_note":"","how_to_check":"- Run `go version` on build machines and CI runners to see the installed toolchain.\n- Check whether builds compile cgo code (`CGO_ENABLED=1`) from packages you do not fully trust.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["cgo-disabled","pure-go-code","trusted-packages-only"],"who_is_affected":"Teams that build Go programs with cgo enabled, including CI runners, and that pull in third-party packages containing cgo directives. The flaw is triggered when a package's #cgo LDFLAGS are processed during the build. Teams that build only pure-Go code or only trusted cgo code can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001089,"input_tokens":4872,"output_tokens":1203,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,22A,25A '-6854':23A '-97037':20A,26A 'accept':118C 'addit':141C 'arbitrari':65B,80C 'argument':105C,122C,176C 'backref':223C 'bare':120C,219C 'build':31B,60B,69B,71C 'caus':79C,171C 'certain':39B 'cgo':15A,28B,36B,77C,96C 'ci':30B 'ci-build':29B 'cmd/go':17A 'code':66B,81C 'command':190C 'compil':129C 'consum':102C 'could':78C,170C 'cve':18A,24A 'darwin':9A,166C 'direct':132C 'disallow':218C 'disk':187C 'driver':130C 'except':204C 'exclud':224C 'execut':82C 'file':90C,140C,185C,216C 'flag':7A,13A,43B,100C,146C,203C,210C 'follow':104C 'framework':149C,151C 'gnu':144C 'go':21A,32B,34B,189C 'host':46B,93C 'inject':3A 'input':139C 'interpret':174C 'just-symbol':111C,155C 'ld.bfd':145C,172C 'ldflag':97C 'let':52B 'link':84C 'linker':1A,12A,42B,47B,58B,88C,94C,135C,178C,214C 'machin':70B 'malici':54B,73C 'name':182C 'non':165C 'non-darwin':164C 'packag':55B,62B,74C 'pass':38B,87C,131C 'platform':167C 'posit':138C 'prefix':126C,195C 'previous':117C 'r':159C,206C 'refer':213C 'regular':184C 'requir':192C 'rpath':109C 'run':64B 'runtim':33B 'script':2A,59B,89C,179C,215C 'second':121C,198C 'sectcreat':169C 'split':5A,40B,98C,201C 'subsystem':161C 'suppli':56B 'support':37B 'symbol':11A,113C,157C 'time':85C 'token':199C 'toolchain':27A 'undefin':116C,153C 'use':76C,143C 'verifi':207C 'via':4A,95C 'warn':222C 'warn-backrefs-exclud':221C 'way':50B 'without':123C 'wl':6A,41B,99C,108C,110C,115C,125C,150C,152C,154C,158C,160C,168C,194C,202C,205C,220C","nicknames":[],"mitigations":[],"who_affected":"Teams that build Go programs with cgo enabled, including CI runners, and that pull in third-party packages containing cgo directives. The flaw is triggered when a package's #cgo LDFLAGS are processed during the build. Teams that build only pure-Go code or only trusted cgo code can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["toolchain"],"ptokens":["toolchain"],"labels":["cgo","cibuilds","go","runtime","unknown"],"campaign_type":null,"search_a":"'-2026':19A,22A,25A '-6854':23A '-97037':20A,26A 'cgo':15A 'cmd/go':17A 'cve':18A,24A 'darwin':9A 'flag':7A,13A 'go':21A 'inject':3A 'linker':1A,12A 'script':2A 'split':5A 'symbol':11A 'toolchain':27A 'via':4A 'wl':6A","search_b":"'arbitrari':65B 'build':31B,60B,69B 'certain':39B 'cgo':28B,36B 'ci':30B 'ci-build':29B 'code':66B 'flag':43B 'go':32B,34B 'host':46B 'let':52B 'linker':42B,47B,58B 'machin':70B 'malici':54B 'packag':55B,62B 'pass':38B 'run':64B 'runtim':33B 'script':59B 'split':40B 'suppli':56B 'support':37B 'way':50B 'wl':41B","search_c":"'accept':118C 'addit':141C 'arbitrari':80C 'argument':105C,122C,176C 'backref':223C 'bare':120C,219C 'build':71C 'caus':79C,171C 'cgo':77C,96C 'code':81C 'command':190C 'compil':129C 'consum':102C 'could':78C,170C 'darwin':166C 'direct':132C 'disallow':218C 'disk':187C 'driver':130C 'except':204C 'exclud':224C 'execut':82C 'file':90C,140C,185C,216C 'flag':100C,146C,203C,210C 'follow':104C 'framework':149C,151C 'gnu':144C 'go':189C 'host':93C 'input':139C 'interpret':174C 'just-symbol':111C,155C 'ld.bfd':145C,172C 'ldflag':97C 'link':84C 'linker':88C,94C,135C,178C,214C 'malici':73C 'name':182C 'non':165C 'non-darwin':164C 'packag':74C 'pass':87C,131C 'platform':167C 'posit':138C 'prefix':126C,195C 'previous':117C 'r':159C,206C 'refer':213C 'regular':184C 'requir':192C 'rpath':109C 'script':89C,179C,215C 'second':121C,198C 'sectcreat':169C 'split':98C,201C 'subsystem':161C 'symbol':113C,157C 'time':85C 'token':199C 'undefin':116C,153C 'use':76C,143C 'verifi':207C 'via':95C 'warn':222C 'warn-backrefs-exclud':221C 'without':123C 'wl':99C,108C,110C,115C,125C,150C,152C,154C,158C,160C,168C,194C,202C,205C,220C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T02:51:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6854","url":"https://pkg.go.dev/vuln/GO-2026-6854","severity":null,"published_at":"2026-11-11T02:51:11+00:00","modified_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:17+00:00","fetched_at":"2026-11-11T03:37:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}