---
id: "CVE-2026-97039"
page: "https://infrastack.ai/live/CVE-2026-97039"
kind: "vulnerability"
aliases: ["CVE-2026-97039", "GO-2026-6852"]
title: "Flag sanitization bypass via \"#cgo pkg-config:\" directives in cmd/go"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "toolchain", "fixed": ["1.26.11", "1.27.4"], "affected": ">= 1.27.0-0, < 1.27.4", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["build-pipelines", "cgo", "go", "runtime"]
not_affected_if: ["cgo-disabled", "no-untrusted-dependencies", "pure-go-code"]
published_at: "2026-11-11T02:51:11+00:00"
first_seen_at: "2026-11-11T03:37:17+00:00"
updated_at: "2026-11-11T03:38:56+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6852", "first_seen_at": "2026-11-11T03:37:17+00:00"}]
exploit_sources: []
---

# Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go

Link for people: https://infrastack.ai/live/CVE-2026-97039 (this .md is for agents)

A Go package containing crafted "#cgo pkg-config:" directives can make the go command load attacker-chosen .pc files or pass unvalidated compiler and linker flags during build. Building such a package can lead to attacker-controlled flags reaching the compiler and linker.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:toolchain affected >= 1.27.0-0, < 1.27.4 fixed 1.26.11, 1.27.4

## How to check

- Run `go version` and compare against the fixed releases `1.26.11` and `1.27.4`.
- Check whether any dependency or vendored module uses `#cgo pkg-config:` directives.

## Fix

- Go toolchain `1.26.11` for the 1.26 line.
- Go toolchain `1.27.4` for the 1.27 line.

## Timeline

- 2026-11-11T03:37:17+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6852

## From the sources

Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags.

The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe.

The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_