{"id":"CVE-2026-97040","kind":"vulnerability","aliases":["CVE-2026-97040","GO-2026-6851"],"related":[],"title":"Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link","description":"Building a package containing a crafted \".syso\" file could bypass cgo flag validation and inject arbitrary linker flags when linking.\n\nWhen loading \".syso\" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A \".syso\" file beginning with a \"go object\" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as \"cgo_ldflag\" or \"cgo_dynamic_linker\") embedded in the \".syso\" file to be passed to the external linker without validation. Additionally, \".syso\" filenames longer than 16 bytes lost their \".syso\" extension when truncated in archive headers, and unrecognized \".syso\" formats forced external linking in pure-Go builds.\n\nThe linker now rejects \".syso\" files that are not recognized host object formats, and \"cmd/go\" and \"cmd/pack\" preserve the \".syso\" suffix when truncating long archive member names.","summary":"A crafted .syso file disguised as a Go object file can smuggle cgo directives such as cgo_ldflag into the build, which are passed unvalidated to the external linker. An attacker who gets such a file into a package being built can run extra linker options, which can lead to code execution on the build machine.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"toolchain","fixed":["1.26.11","1.27.4"],"affected":">= 1.27.0-0, < 1.27.4","ecosystem":"go"}],"ecosystems":["go"],"tags":["build-systems","cgo","ci","go","runtime"],"not_affected_if":["no-syso-files","trusted-sources-only"],"how_to_check":"- Run `go version` and compare against the fixed versions.\n- Check whether builds pull in untrusted packages that contain .syso files.","fix":"- Go `1.26.11`\n- Go `1.27.4`","status":"open","published_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:16+00:00","triaged_at":"2026-11-11T03:38:51+00:00","updated_at":"2026-11-11T03:38:51+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T03:38:51Z","model":"claude-haiku-5-5","output":{"fix":"- Go `1.26.11`\n- Go `1.27.4`","reach":"local","title":"Go toolchain: crafted .syso file injects linker flags during build","impact":"high","summary":"A crafted .syso file disguised as a Go object file can smuggle cgo directives such as cgo_ldflag into the build, which are passed unvalidated to the external linker. An attacker who gets such a file into a package being built can run extra linker options, which can lead to code execution on the build machine.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["go","cgo","ci","build-systems"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker-chosen linker flags run during the build on the machine","analyst_note":"","how_to_check":"- Run `go version` and compare against the fixed versions.\n- Check whether builds pull in untrusted packages that contain .syso files.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-sources-only","no-syso-files"],"who_is_affected":"Teams that build Go programs from third-party or untrusted packages that include .syso files, including cgo builds. Builds using only trusted source and no vendored .syso files are much less exposed. unknown whether a specific exploit path has been demonstrated.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000729,"input_tokens":4823,"output_tokens":493,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A,23A '-6851':21A '-97040':18A,24A '16':188C 'addit':183C 'allow':156C 'arbitrari':104C 'archiv':116C,197C,235C 'attack':63B 'begin':143C 'build':27B,53B,87B,89C,210C 'build-system':26B 'built':73B 'bypass':98C 'byte':189C 'cgo':1A,29B,45B,49B,99C,158C,163C,166C 'check':120C 'ci':30B 'cmd/go':13A,225C 'cmd/link':15A 'cmd/pack':227C 'code':83B 'compil':154C 'contain':92C 'could':97C 'craft':34B,94C 'cve':16A,22A 'direct':2A,46B,160C 'disguis':7A,37B 'dynam':167C 'elf':126C 'embed':169C 'entri':112C 'execut':84B 'extens':193C 'extern':60B,179C,204C 'extra':76B 'fall':134C 'file':6A,11A,36B,42B,68B,96C,142C,173C,216C 'filenam':185C 'flag':100C,106C 'forc':203C 'format':202C,223C 'get':65B 'go':9A,19A,31B,40B,137C,146C,153C,209C 'header':125C,148C,198C 'host':123C,221C 'inject':3A,103C 'ldflag':50B,164C 'lead':81B 'link':108C,205C 'linker':61B,77B,105C,118C,168C,180C,212C 'load':110C 'long':234C 'longer':186C 'lost':190C 'mach':128C 'mach-o':127C 'machin':88B 'member':236C 'metadata':159C 'name':237C 'o':129C 'object':10A,41B,124C,138C,147C,155C,222C 'option':78B 'packag':71B,91C,115C 'pars':139C,150C 'pass':56B,176C 'pe':130C 'preserv':228C 'pure':208C 'pure-go':207C 'recogn':122C,220C 'reject':214C 'run':75B 'runtim':32B 'smuggl':44B 'suffix':231C 'syso':5A,35B,95C,111C,141C,172C,184C,192C,201C,215C,230C 'system':28B 'toolchain':25A 'truncat':195C,233C 'unrecogn':200C 'untrust':157C 'unvalid':57B 'valid':101C,182C 'via':4A 'without':181C 'xcoff':132C","nicknames":[],"mitigations":[],"who_affected":"Teams that build Go programs from third-party or untrusted packages that include .syso files, including cgo builds. Builds using only trusted source and no vendored .syso files are much less exposed. unknown whether a specific exploit path has been demonstrated.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["toolchain"],"ptokens":["toolchain"],"labels":["buildsystems","cgo","ci","go","runtime","unknown"],"campaign_type":null,"search_a":"'-2026':17A,20A,23A '-6851':21A '-97040':18A,24A 'cgo':1A 'cmd/go':13A 'cmd/link':15A 'cve':16A,22A 'direct':2A 'disguis':7A 'file':6A,11A 'go':9A,19A 'inject':3A 'object':10A 'syso':5A 'toolchain':25A 'via':4A","search_b":"'attack':63B 'build':27B,53B,87B 'build-system':26B 'built':73B 'cgo':29B,45B,49B 'ci':30B 'code':83B 'craft':34B 'direct':46B 'disguis':37B 'execut':84B 'extern':60B 'extra':76B 'file':36B,42B,68B 'get':65B 'go':31B,40B 'ldflag':50B 'lead':81B 'linker':61B,77B 'machin':88B 'object':41B 'option':78B 'packag':71B 'pass':56B 'run':75B 'runtim':32B 'smuggl':44B 'syso':35B 'system':28B 'unvalid':57B","search_c":"'16':188C 'addit':183C 'allow':156C 'arbitrari':104C 'archiv':116C,197C,235C 'begin':143C 'build':89C,210C 'bypass':98C 'byte':189C 'cgo':99C,158C,163C,166C 'check':120C 'cmd/go':225C 'cmd/pack':227C 'compil':154C 'contain':92C 'could':97C 'craft':94C 'direct':160C 'dynam':167C 'elf':126C 'embed':169C 'entri':112C 'extens':193C 'extern':179C,204C 'fall':134C 'file':96C,142C,173C,216C 'filenam':185C 'flag':100C,106C 'forc':203C 'format':202C,223C 'go':137C,146C,153C,209C 'header':125C,148C,198C 'host':123C,221C 'inject':103C 'ldflag':164C 'link':108C,205C 'linker':105C,118C,168C,180C,212C 'load':110C 'long':234C 'longer':186C 'lost':190C 'mach':128C 'mach-o':127C 'member':236C 'metadata':159C 'name':237C 'o':129C 'object':124C,138C,147C,155C,222C 'packag':91C,115C 'pars':139C,150C 'pass':176C 'pe':130C 'preserv':228C 'pure':208C 'pure-go':207C 'recogn':122C,220C 'reject':214C 'suffix':231C 'syso':95C,111C,141C,172C,184C,192C,201C,215C,230C 'truncat':195C,233C 'unrecogn':200C 'untrust':157C 'valid':101C,182C 'without':181C 'xcoff':132C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T02:51:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6851","url":"https://pkg.go.dev/vuln/GO-2026-6851","severity":null,"published_at":"2026-11-11T02:51:11+00:00","modified_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:16+00:00","fetched_at":"2026-11-11T03:37:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}