TOOLCHAIN · CVE-2026-97041 · Runtime
FIX → 1.27.4 +1
A malicious Go package using special //go:cgo_* compiler directives can smuggle extra flags into the external linker run on ELF systems. The injected flags can cause the linker to load or write unintended files on the build machine.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only builds on ELF platforms (Linux and similar) that compile Go code containing cgo directives from untrusted or unvetted packages are exposed. Teams that build only their own trusted code or use non-ELF targets have a lower risk. Upgrading the toolchain removes the exposure for all builds.
Not affected if no-cgo-directives, non-elf-target, trusted-packages-only
Who cares ci, go, go-builds, linux
Unknown from the sources.
Upgrade to 1.27.4 +1
1.26.111.27.4Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms.
The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments.
The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.