TOOLCHAIN · CVE-2026-97038 · Package
FIX → 1.27.4 +1
A Go package containing crafted .syso files or cgo linker inputs can inject linker flags or run code while the project is built. The attacker gets code execution on the machine or CI runner that compiles the malicious package.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone building Go code with the affected toolchain, especially when compiling third-party packages that use cgo or include .syso files. Projects that only build their own trusted code with no cgo dependencies are less exposed. Build machines and CI runners that fetch untrusted modules are the main concern.
Not affected if no-cgo, toolchain-upgraded, trusted-deps-only
Who cares build-servers, cgo, ci, go
go version and confirm the toolchain is below 1.26.11 on the 1.26 line or below 1.27.4 on the 1.27 line.Upgrade to 1.27.4 +1
1.27.4Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time.
Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFLAGS", and libraries in "-L" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or ".syso" files (or loaded via "-l:<filename>" or "-l" containing path separators), injecting unallowlisted linker flags via PE/COFF ".drectve" sections on Windows or Mach-O "LC_LINKER_OPTION" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects.
The go command now verifies that ".syso" files, direct linker inputs, and libraries in "-L" directories are valid binary objects or archives that do not contain unallowlisted ".drectve" directives, "LC_LINKER_OPTION" load commands, or LTO IR sections, and disallows "-l:<filename>" and ":", "=", or path separators in "-l" flags.
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.26.11