{"id":"CVE-2026-97039","kind":"vulnerability","aliases":["CVE-2026-97039","GO-2026-6852"],"related":[],"title":"Flag sanitization bypass via \"#cgo pkg-config:\" directives in cmd/go","description":"Building a malicious package that uses \"#cgo pkg-config:\" directives could load untrusted pkg-config \".pc\" files or inject unvalidated compiler and linker flags.\n\nThe pkg-config flag allowlist previously permitted \"--with-path=\" and \"--personality=\", allowed \"--define-variable=\" values beginning with \"=\" or \"$\" (which can rewrite paths in system \".pc\" files into sysroot-prefixed \"-L=\" or \"-L$SYSROOT\" linker search paths), and allowed package arguments ending in \".pc\" or containing path separators or \"..\", which caused pkg-config to load local \".pc\" files directly from the package directory. In addition, flags returned by \"pkg-config --cflags\" in cgoCPPFLAGS were not checked when determining whether internal linking is safe.\n\nThe go command now disallows \"--with-path=\", \"--personality=\", leading \"=\" or \"$\" characters in \"--define-variable=\" values, and local \".pc\" paths in \"#cgo pkg-config:\" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.","summary":"A Go package containing crafted \"#cgo pkg-config:\" directives can make the go command load attacker-chosen .pc files or pass unvalidated compiler and linker flags during build. Building such a package can lead to attacker-controlled flags reaching the compiler and linker.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"toolchain","fixed":["1.26.11","1.27.4"],"affected":">= 1.27.0-0, < 1.27.4","ecosystem":"go"}],"ecosystems":["go"],"tags":["build-pipelines","cgo","go","runtime"],"not_affected_if":["cgo-disabled","no-untrusted-dependencies","pure-go-code"],"how_to_check":"- Run `go version` and compare against the fixed releases `1.26.11` and `1.27.4`.\n- Check whether any dependency or vendored module uses `#cgo pkg-config:` directives.","fix":"- Go toolchain `1.26.11` for the 1.26 line.\n- Go toolchain `1.27.4` for the 1.27 line.","status":"open","published_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:17+00:00","triaged_at":"2026-11-11T03:38:56+00:00","updated_at":"2026-11-11T03:38:56+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T03:38:56Z","model":"claude-haiku-5-5","output":{"fix":"- Go toolchain `1.26.11` for the 1.26 line.\n- Go toolchain `1.27.4` for the 1.27 line.","reach":"local","title":"Go toolchain: cgo pkg-config directives let a malicious package inject linker flags","impact":"medium","summary":"A Go package containing crafted \"#cgo pkg-config:\" directives can make the go command load attacker-chosen .pc files or pass unvalidated compiler and linker flags during build. Building such a package can lead to attacker-controlled flags reaching the compiler and linker.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["go","cgo","build-pipelines"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker-chosen linker flags run during a build on the build machine","analyst_note":"","how_to_check":"- Run `go version` and compare against the fixed releases `1.26.11` and `1.27.4`.\n- Check whether any dependency or vendored module uses `#cgo pkg-config:` directives.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["pure-go-code","cgo-disabled","no-untrusted-dependencies"],"who_is_affected":"Teams that build Go code with cgo enabled, especially those who fetch and compile third-party modules that use #cgo pkg-config directives. Builds that use only pure Go code or do not compile untrusted packages are unlikely to be affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00076,"input_tokens":4843,"output_tokens":552,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A,19A '-6852':17A '-97039':14A,20A 'addit':168C 'allow':113C,141C 'allowlist':105C 'argument':143C 'attack':45B,66B 'attacker-chosen':44B 'attacker-control':65B 'begin':118C 'build':23B,57B,58B,74C 'build-pipelin':22B 'bypass':3A 'caus':153C 'cflag':175C 'cgo':5A,25B,33B,80C,210C 'cgocppflag':177C,217C 'charact':199C 'check':180C,219C 'chosen':46B 'cmd/go':11A 'command':42B,190C 'compat':222C 'compil':52B,71B,96C 'config':8A,36B,83C,90C,103C,156C,174C,213C 'contain':31B,148C 'control':67B 'could':85C 'craft':32B 'cve':12A,18A 'defin':115C,202C 'define-vari':114C,201C 'determin':182C 'direct':9A,37B,84C,162C,214C 'directori':166C 'disallow':192C 'end':144C 'file':48B,92C,128C,161C 'flag':1A,55B,68B,99C,104C,169C 'go':15A,26B,29B,41B,189C 'inject':94C 'inspect':216C 'intern':184C,220C 'l':133C,135C 'lead':63B,197C 'link':185C,221C 'linker':54B,73B,98C,137C 'load':43B,86C,158C 'local':159C,206C 'make':39B 'malici':76C 'packag':30B,61B,77C,142C,165C 'pass':50B 'path':110C,124C,139C,149C,195C,208C 'pc':47B,91C,127C,146C,160C,207C 'permit':107C 'person':112C,196C 'pipelin':24B 'pkg':7A,35B,82C,89C,102C,155C,173C,212C 'pkg-config':6A,34B,81C,88C,101C,154C,172C,211C 'prefix':132C 'previous':106C 'reach':69B 'return':170C 'rewrit':123C 'runtim':27B 'safe':187C 'sanit':2A 'search':138C 'separ':150C 'sysroot':131C,136C 'sysroot-prefix':130C 'system':126C 'toolchain':21A 'untrust':87C 'unvalid':51B,95C 'use':79C 'valu':117C,204C 'variabl':116C,203C 'via':4A 'whether':183C 'with-path':108C,193C","nicknames":[],"mitigations":[],"who_affected":"Teams that build Go code with cgo enabled, especially those who fetch and compile third-party modules that use #cgo pkg-config directives. Builds that use only pure Go code or do not compile untrusted packages are unlikely to be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["toolchain"],"ptokens":["toolchain"],"labels":["buildpipelines","cgo","go","high","runtime"],"campaign_type":null,"search_a":"'-2026':13A,16A,19A '-6852':17A '-97039':14A,20A 'bypass':3A 'cgo':5A 'cmd/go':11A 'config':8A 'cve':12A,18A 'direct':9A 'flag':1A 'go':15A 'pkg':7A 'pkg-config':6A 'sanit':2A 'toolchain':21A 'via':4A","search_b":"'attack':45B,66B 'attacker-chosen':44B 'attacker-control':65B 'build':23B,57B,58B 'build-pipelin':22B 'cgo':25B,33B 'chosen':46B 'command':42B 'compil':52B,71B 'config':36B 'contain':31B 'control':67B 'craft':32B 'direct':37B 'file':48B 'flag':55B,68B 'go':26B,29B,41B 'lead':63B 'linker':54B,73B 'load':43B 'make':39B 'packag':30B,61B 'pass':50B 'pc':47B 'pipelin':24B 'pkg':35B 'pkg-config':34B 'reach':69B 'runtim':27B 'unvalid':51B","search_c":"'addit':168C 'allow':113C,141C 'allowlist':105C 'argument':143C 'begin':118C 'build':74C 'caus':153C 'cflag':175C 'cgo':80C,210C 'cgocppflag':177C,217C 'charact':199C 'check':180C,219C 'command':190C 'compat':222C 'compil':96C 'config':83C,90C,103C,156C,174C,213C 'contain':148C 'could':85C 'defin':115C,202C 'define-vari':114C,201C 'determin':182C 'direct':84C,162C,214C 'directori':166C 'disallow':192C 'end':144C 'file':92C,128C,161C 'flag':99C,104C,169C 'go':189C 'inject':94C 'inspect':216C 'intern':184C,220C 'l':133C,135C 'lead':197C 'link':185C,221C 'linker':98C,137C 'load':86C,158C 'local':159C,206C 'malici':76C 'packag':77C,142C,165C 'path':110C,124C,139C,149C,195C,208C 'pc':91C,127C,146C,160C,207C 'permit':107C 'person':112C,196C 'pkg':82C,89C,102C,155C,173C,212C 'pkg-config':81C,88C,101C,154C,172C,211C 'prefix':132C 'previous':106C 'return':170C 'rewrit':123C 'safe':187C 'search':138C 'separ':150C 'sysroot':131C,136C 'sysroot-prefix':130C 'system':126C 'untrust':87C 'unvalid':95C 'use':79C 'valu':117C,204C 'variabl':116C,203C 'whether':183C 'with-path':108C,193C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T02:51:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6852","url":"https://pkg.go.dev/vuln/GO-2026-6852","severity":null,"published_at":"2026-11-11T02:51:11+00:00","modified_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:17+00:00","fetched_at":"2026-11-11T03:37:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}