TOOLCHAIN · CVE-2026-97042 · Runtime
FIX → 1.27.4 +1
A malicious Go package can use a crafted cgo_import_dynamic directive or a crafted Windows PE object to inject arguments into the external linker. This can make the linker reference arbitrary files on disk, including through ../ path traversal.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that compile Go code, especially on Windows or with cgo enabled, are exposed when they build untrusted or unvetted third-party packages. Teams that only run prebuilt binaries and never compile untrusted Go code are unlikely to be affected by the build-time issue.
Not affected if no-cgo, prebuilt-binaries-only, trusted-dependencies
Who cares cgo, ci, go, windows
go version on build machines and CI runners, to see whether the toolchain is in the affected range (1.27.0 up to 1.27.4)Upgrade to 1.27.4 +1
1.26.11 for the 1.26 line1.27.4 for the 1.27 lineBuilding a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker.
The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk.
The compiler now validates every character of the library name in "//go:cgo_import_dynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
Go Vulnerability Database, CC-BY 4.0. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.