{"id":"CVE-2026-97038","kind":"vulnerability","aliases":["CVE-2026-97038","GO-2026-6853"],"related":[],"title":"Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go","description":"Building a malicious package containing \".syso\" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time.\n\nLinker input files—including \".syso\" files, direct object or library inputs in \"#cgo LDFLAGS\", and libraries in \"-L\" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or \".syso\" files (or loaded via \"-l:<filename>\" or \"-l\" containing path separators), injecting unallowlisted linker flags via PE/COFF \".drectve\" sections on Windows or Mach-O \"LC_LINKER_OPTION\" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects.\n\nThe go command now verifies that \".syso\" files, direct linker inputs, and libraries in \"-L\" directories are valid binary objects or archives that do not contain unallowlisted \".drectve\" directives, \"LC_LINKER_OPTION\" load commands, or LTO IR sections, and disallows \"-l:<filename>\" and \":\", \"=\", or path separators in \"-l\" flags.","summary":"A Go package containing crafted .syso files or cgo linker inputs can inject linker flags or run code while the project is built. The attacker gets code execution on the machine or CI runner that compiles the malicious package.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"toolchain","fixed":["1.26.11","1.27.4"],"affected":">= 1.27.0-0, < 1.27.4","ecosystem":"go"}],"ecosystems":["go"],"tags":["build-servers","cgo","ci","go","package"],"not_affected_if":["no-cgo","toolchain-upgraded","trusted-deps-only"],"how_to_check":"- Run `go version` and confirm the toolchain is below `1.26.11` on the 1.26 line or below `1.27.4` on the 1.27 line.\n- Check whether the project or its dependencies use cgo or ship .syso files.","fix":"- Go toolchain 1.27.x: upgrade to `1.27.4`\n- Go toolchain 1.26.x: upgrade to `1.26.11`","status":"open","published_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:17+00:00","triaged_at":"2026-11-11T03:38:56+00:00","updated_at":"2026-11-11T03:38:56+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T03:38:56Z","model":"claude-haiku-5-5","output":{"fix":"- Go toolchain 1.27.x: upgrade to `1.27.4`\n- Go toolchain 1.26.x: upgrade to `1.26.11`","reach":"local","title":"Go toolchain: malicious .syso or cgo linker input runs code at build time","impact":"high","summary":"A Go package containing crafted .syso files or cgo linker inputs can inject linker flags or run code while the project is built. The attacker gets code execution on the machine or CI runner that compiles the malicious package.","audience":"developers","category":"package","nicknames":[],"who_cares":["go","cgo","ci","build-servers"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"code runs on the build machine during linking","analyst_note":"product_name empty; products listed. Severity from sources is unknown, so the impact is inferred from the description.","how_to_check":"- Run `go version` and confirm the toolchain is below `1.26.11` on the 1.26 line or below `1.27.4` on the 1.27 line.\n- Check whether the project or its dependencies use cgo or ship .syso files.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["toolchain-upgraded","no-cgo","trusted-deps-only"],"who_is_affected":"Anyone building Go code with the affected toolchain, especially when compiling third-party packages that use cgo or include .syso files. Projects that only build their own trusted code with no cgo dependencies are less exposed. Build machines and CI runners that fetch untrusted modules are the main concern.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000778,"input_tokens":4908,"output_tokens":575,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A,22A '-6853':20A '-97038':17A,23A 'across':129C 'allow':132C 'arbitrari':1A,84C,89C 'archiv':216C 'attack':56B 'binari':213C 'build':26B,71C 'build-serv':25B 'built':54B 'cgo':9A,28B,40B,79C,106C 'check':124C 'ci':29B,64B 'cmd/go':14A 'code':2A,49B,58B,90C 'command':172C,197C,228C 'compil':67B 'contain':35B,75C,151C,220C 'could':82C 'craft':5A,36B 'cve':15A,21A 'darwin':174C 'direct':100C,203C,223C 'directori':112C,210C 'disallow':234C 'disguis':139C 'drectv':160C,222C 'elf':188C 'embed':126C 'execut':3A,59B,88C,133C 'extern':117C 'file':7A,12A,38B,77C,96C,99C,144C,202C 'flag':46B,86C,157C,242C 'format':122C 'gcc':180C 'get':57B 'gnu':134C 'go':18A,30B,33B,196C 'implicit':136C 'includ':97C 'inject':44B,83C,154C 'input':11A,42B,81C,95C,104C,205C 'intermedi':184C 'invok':176C 'ir':231C 'l':111C,148C,150C,209C,235C,241C 'lc':168C,224C 'ld':135C 'ldflag':107C 'librari':103C,109C,141C,207C 'link':92C 'linker':10A,41B,45B,80C,85C,94C,118C,127C,137C,156C,169C,204C,225C 'llvm':182C 'load':146C,171C,227C 'lto':177C,183C,230C 'mach':166C,192C 'mach-o':165C,191C 'machin':62B 'malici':69B,73C 'o':167C,193C 'object':101C,194C,214C 'option':128C,170C,226C 'packag':31B,34B,70B,74C 'pass':114C 'path':152C,238C 'pe/coff':159C,189C 'platform':130C 'plugin':178C 'project':52B 'represent':185C 'run':48B 'runner':65B 'script':138C 'section':161C,186C,232C 'separ':153C,239C 'server':27B 'syso':6A,37B,76C,98C,143C,201C 'time':93C 'toolchain':24A 'unallowlist':155C,221C 'valid':120C,212C 'verifi':199C 'via':4A,147C,158C,179C 'window':163C 'without':119C","nicknames":[],"mitigations":[],"who_affected":"Anyone building Go code with the affected toolchain, especially when compiling third-party packages that use cgo or include .syso files. Projects that only build their own trusted code with no cgo dependencies are less exposed. Build machines and CI runners that fetch untrusted modules are the main concern.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["toolchain"],"ptokens":["toolchain"],"labels":["buildservers","cgo","ci","go","high","package"],"campaign_type":null,"search_a":"'-2026':16A,19A,22A '-6853':20A '-97038':17A,23A 'arbitrari':1A 'cgo':9A 'cmd/go':14A 'code':2A 'craft':5A 'cve':15A,21A 'execut':3A 'file':7A,12A 'go':18A 'input':11A 'linker':10A 'syso':6A 'toolchain':24A 'via':4A","search_b":"'attack':56B 'build':26B 'build-serv':25B 'built':54B 'cgo':28B,40B 'ci':29B,64B 'code':49B,58B 'compil':67B 'contain':35B 'craft':36B 'execut':59B 'file':38B 'flag':46B 'get':57B 'go':30B,33B 'inject':44B 'input':42B 'linker':41B,45B 'machin':62B 'malici':69B 'packag':31B,34B,70B 'project':52B 'run':48B 'runner':65B 'server':27B 'syso':37B","search_c":"'across':129C 'allow':132C 'arbitrari':84C,89C 'archiv':216C 'binari':213C 'build':71C 'cgo':79C,106C 'check':124C 'code':90C 'command':172C,197C,228C 'contain':75C,151C,220C 'could':82C 'darwin':174C 'direct':100C,203C,223C 'directori':112C,210C 'disallow':234C 'disguis':139C 'drectv':160C,222C 'elf':188C 'embed':126C 'execut':88C,133C 'extern':117C 'file':77C,96C,99C,144C,202C 'flag':86C,157C,242C 'format':122C 'gcc':180C 'gnu':134C 'go':196C 'implicit':136C 'includ':97C 'inject':83C,154C 'input':81C,95C,104C,205C 'intermedi':184C 'invok':176C 'ir':231C 'l':111C,148C,150C,209C,235C,241C 'lc':168C,224C 'ld':135C 'ldflag':107C 'librari':103C,109C,141C,207C 'link':92C 'linker':80C,85C,94C,118C,127C,137C,156C,169C,204C,225C 'llvm':182C 'load':146C,171C,227C 'lto':177C,183C,230C 'mach':166C,192C 'mach-o':165C,191C 'malici':73C 'o':167C,193C 'object':101C,194C,214C 'option':128C,170C,226C 'packag':74C 'pass':114C 'path':152C,238C 'pe/coff':159C,189C 'platform':130C 'plugin':178C 'represent':185C 'script':138C 'section':161C,186C,232C 'separ':153C,239C 'syso':76C,98C,143C,201C 'time':93C 'unallowlist':155C,221C 'valid':120C,212C 'verifi':199C 'via':147C,158C,179C 'window':163C 'without':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T02:51:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6853","url":"https://pkg.go.dev/vuln/GO-2026-6853","severity":null,"published_at":"2026-11-11T02:51:11+00:00","modified_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:17+00:00","fetched_at":"2026-11-11T03:37:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}