TOOLCHAIN · CVE-2026-97039 · Runtime
FIX → 1.27.4 +1
A Go package containing crafted "#cgo pkg-config:" directives can make the go command load attacker-chosen .pc files or pass unvalidated compiler and linker flags during build. Building such a package can lead to attacker-controlled flags reaching the compiler and linker.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that build Go code with cgo enabled, especially those who fetch and compile third-party modules that use #cgo pkg-config directives. Builds that use only pure Go code or do not compile untrusted packages are unlikely to be affected.
Not affected if cgo-disabled, no-untrusted-dependencies, pure-go-code
Who cares build-pipelines, cgo, go
go version and compare against the fixed releases 1.26.11 and 1.27.4.#cgo pkg-config: directives.Upgrade to 1.27.4 +1
1.26.11 for the 1.26 line.Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags.
The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe.
The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.27.4 for the 1.27 line.