---
id: "CVE-2026-97041"
page: "https://infrastack.ai/live/CVE-2026-97041"
kind: "vulnerability"
aliases: ["CVE-2026-97041", "GO-2026-6850"]
title: "Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "toolchain", "fixed": ["1.26.11", "1.27.4"], "affected": ">= 1.27.0-0, < 1.27.4", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["ci", "go", "go-builds", "linux", "runtime"]
not_affected_if: ["no-cgo-directives", "non-elf-target", "trusted-packages-only"]
published_at: "2026-11-11T02:51:11+00:00"
first_seen_at: "2026-11-11T03:37:16+00:00"
updated_at: "2026-11-11T03:38:51+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6850", "first_seen_at": "2026-11-11T03:37:16+00:00"}]
exploit_sources: []
---

# Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link

Link for people: https://infrastack.ai/live/CVE-2026-97041 (this .md is for agents)

A malicious Go package using special //go:cgo_* compiler directives can smuggle extra flags into the external linker run on ELF systems. The injected flags can cause the linker to load or write unintended files on the build machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:toolchain affected >= 1.27.0-0, < 1.27.4 fixed 1.26.11, 1.27.4

## Fix

- Go toolchain 1.26 line: `1.26.11`
- Go toolchain 1.27 line: `1.27.4`

## Timeline

- 2026-11-11T03:37:16+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6850

## From the sources

Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms.

The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments.

The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_