{"id":"CVE-2026-97041","kind":"vulnerability","aliases":["CVE-2026-97041","GO-2026-6850"],"related":[],"title":"Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link","description":"Building a malicious package containing \"//go:cgo_*\" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms.\n\nThe compiler and linker did not reject commas in \"//go:cgo_import_dynamic\", \"//go:cgo_export_dynamic\", \"//go:cgo_export_static\", \"//go:cgo_import_static\", and \"//go:cgo_dynamic_linker\" directives, and the linker passed the dynamic linker path using \"-Wl,--dynamic-linker,<path>\". Furthermore, the two-argument form of \"//go:cgo_import_dynamic\" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading \"@\" could split \"-Wl,--export-dynamic-symbol=\" or \"-Wl,--dynamic-linker,\" into arbitrary host linker flags or response file arguments.\n\nThe compiler and linker now reject commas in \"//go:cgo_*\" symbol and dynamic linker directives, the linker passes \"-Wl,--dynamic-linker=<path>\", and \"cgo_import_dynamic\" no longer overwrites symbols exported via \"cgo_export_dynamic\" or \"cgo_export_static\".","summary":"A malicious Go package using special //go:cgo_* compiler directives can smuggle extra flags into the external linker run on ELF systems. The injected flags can cause the linker to load or write unintended files on the build machine.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"toolchain","fixed":["1.26.11","1.27.4"],"affected":">= 1.27.0-0, < 1.27.4","ecosystem":"go"}],"ecosystems":["go"],"tags":["ci","go","go-builds","linux","runtime"],"not_affected_if":["no-cgo-directives","non-elf-target","trusted-packages-only"],"how_to_check":null,"fix":"- Go toolchain 1.26 line: `1.26.11`\n- Go toolchain 1.27 line: `1.27.4`","status":"open","published_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:16+00:00","triaged_at":"2026-11-11T03:38:51+00:00","updated_at":"2026-11-11T03:38:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-11T03:38:51Z","model":"claude-haiku-5-5","output":{"fix":"- Go toolchain 1.26 line: `1.26.11`\n- Go toolchain 1.27 line: `1.27.4`","reach":"local","title":"Go toolchain: malicious package can inject linker flags during build","impact":"high","summary":"A malicious Go package using special //go:cgo_* compiler directives can smuggle extra flags into the external linker run on ELF systems. The injected flags can cause the linker to load or write unintended files on the build machine.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["go","linux","ci","go-builds"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"build machine runs attacker-chosen linker flags during compilation","analyst_note":"","how_to_check":"- Run `go version` and confirm the toolchain is below `1.26.11` on the 1.26 line, or between `1.27.0` and `1.27.3` on the 1.27 line.\n- Check whether builds pull in third-party packages that use cgo directives, since those are the only way to reach the flaw.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-packages-only","non-elf-target","no-cgo-directives"],"who_is_affected":"Only builds on ELF platforms (Linux and similar) that compile Go code containing cgo directives from untrusted or unvetted packages are exposed. Teams that build only their own trusted code or use non-ELF targets have a lower risk. Upgrading the toolchain removes the exposure for all builds.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000777,"input_tokens":4917,"output_tokens":570,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A,20A '-6850':18A '-97041':15A,21A '/go':6A,36B,74C,99C,103C,107C,111C,116C,141C,210C 'alreadi':164C 'arbitrari':80C,194C 'argument':138C,201C 'build':27B,67B,69C 'caus':56B 'cgo':7A,37B,75C,100C,104C,108C,112C,117C,142C,151C,167C,211C,225C,234C,238C 'ci':23B 'cmd/compile':10A 'cmd/link':12A 'comma':97C,178C,208C 'compil':38B,76C,91C,203C 'contain':73C,176C 'could':78C,155C,181C 'cve':13A,19A 'direct':8A,39B,77C,120C,216C 'dynam':102C,106C,118C,126C,132C,144C,173C,186C,191C,214C,222C,227C,236C 'dynamic-link':131C,190C,221C 'elf':50B,88C 'export':105C,109C,168C,185C,232C,235C,239C 'export-dynamic-symbol':184C 'extern':46B,84C,158C 'extra':42B 'file':64B,154C,200C 'flag':3A,43B,54B,81C,197C 'form':139C 'furthermor':134C 'go':16A,24B,26B,32B,152C 'go-build':25B 'host':1A,195C 'import':101C,113C,143C,226C 'inject':4A,53B,79C 'invoc':86C 'lead':180C 'linker':2A,47B,58B,85C,93C,119C,123C,127C,133C,174C,192C,196C,205C,215C,218C,223C 'linux':28B 'load':60B 'longer':229C 'machin':68B 'malici':31B,71C 'mark':165C 'name':160C,171C 'non':150C 'non-cgo':149C 'overwrit':156C,230C 'packag':33B,72C 'pass':124C,219C 'path':128C,175C 'permit':147C 'platform':89C 'reject':96C,207C 'respons':199C 'run':48B 'runtim':29B 'smuggl':41B 'sourc':153C 'special':35B 'split':182C 'static':110C,114C,240C 'symbol':159C,163C,170C,187C,212C,231C 'system':51B 'toolchain':22A 'two':137C 'two-argu':136C 'unintend':63B 'use':34B,129C 'via':5A,233C 'wl':130C,183C,189C,220C 'write':62B","nicknames":[],"mitigations":[],"who_affected":"Only builds on ELF platforms (Linux and similar) that compile Go code containing cgo directives from untrusted or unvetted packages are exposed. Teams that build only their own trusted code or use non-ELF targets have a lower risk. Upgrading the toolchain removes the exposure for all builds.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["toolchain"],"ptokens":["toolchain"],"labels":["ci","go","gobuilds","linux","medium","runtime"],"campaign_type":null,"search_a":"'-2026':14A,17A,20A '-6850':18A '-97041':15A,21A '/go':6A 'cgo':7A 'cmd/compile':10A 'cmd/link':12A 'cve':13A,19A 'direct':8A 'flag':3A 'go':16A 'host':1A 'inject':4A 'linker':2A 'toolchain':22A 'via':5A","search_b":"'/go':36B 'build':27B,67B 'caus':56B 'cgo':37B 'ci':23B 'compil':38B 'direct':39B 'elf':50B 'extern':46B 'extra':42B 'file':64B 'flag':43B,54B 'go':24B,26B,32B 'go-build':25B 'inject':53B 'linker':47B,58B 'linux':28B 'load':60B 'machin':68B 'malici':31B 'packag':33B 'run':48B 'runtim':29B 'smuggl':41B 'special':35B 'system':51B 'unintend':63B 'use':34B 'write':62B","search_c":"'/go':74C,99C,103C,107C,111C,116C,141C,210C 'alreadi':164C 'arbitrari':80C,194C 'argument':138C,201C 'build':69C 'cgo':75C,100C,104C,108C,112C,117C,142C,151C,167C,211C,225C,234C,238C 'comma':97C,178C,208C 'compil':76C,91C,203C 'contain':73C,176C 'could':78C,155C,181C 'direct':77C,120C,216C 'dynam':102C,106C,118C,126C,132C,144C,173C,186C,191C,214C,222C,227C,236C 'dynamic-link':131C,190C,221C 'elf':88C 'export':105C,109C,168C,185C,232C,235C,239C 'export-dynamic-symbol':184C 'extern':84C,158C 'file':154C,200C 'flag':81C,197C 'form':139C 'furthermor':134C 'go':152C 'host':195C 'import':101C,113C,143C,226C 'inject':79C 'invoc':86C 'lead':180C 'linker':85C,93C,119C,123C,127C,133C,174C,192C,196C,205C,215C,218C,223C 'longer':229C 'malici':71C 'mark':165C 'name':160C,171C 'non':150C 'non-cgo':149C 'overwrit':156C,230C 'packag':72C 'pass':124C,219C 'path':128C,175C 'permit':147C 'platform':89C 'reject':96C,207C 'respons':199C 'sourc':153C 'split':182C 'static':110C,114C,240C 'symbol':159C,163C,170C,187C,212C,231C 'two':137C 'two-argu':136C 'use':129C 'via':233C 'wl':130C,183C,189C,220C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T02:51:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6850","url":"https://pkg.go.dev/vuln/GO-2026-6850","severity":null,"published_at":"2026-11-11T02:51:11+00:00","modified_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:16+00:00","fetched_at":"2026-11-11T03:37:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}