{"id":"CVE-2026-97042","kind":"vulnerability","aliases":["CVE-2026-97042","GO-2026-6849"],"related":[],"title":"Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link","description":"Building a malicious package that uses \"//go:cgo_import_dynamic\" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker.\n\nThe compiler only checked the first character of the library name in \"//go:cgo_import_dynamic\" directives and skipped validation in cgo-generated files. In addition, on Windows, \"cmd/cgo\" and \"cmd/link\" did not validate imported DLL names extracted from PE object files before emitting \"-l<name>\" flags for the external linker, allowing a crafted DLL name containing \"..\" path traversal or special characters to reference arbitrary files on disk.\n\nThe compiler now validates every character of the library name in \"//go:cgo_import_dynamic\" directives (including in cgo-generated files on Windows) and rejects \"..\" path traversal, and \"cmd/cgo\" and \"cmd/link\" reject PE imported DLL names containing path separators, \"..\", \":\", or leading \"-\" or \"@\".","summary":"A malicious Go package can use a crafted cgo_import_dynamic directive or a crafted Windows PE object to inject arguments into the external linker. This can make the linker reference arbitrary files on disk, including through ../ path traversal.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"toolchain","fixed":["1.26.11","1.27.4"],"affected":">= 1.27.0-0, < 1.27.4","ecosystem":"go"}],"ecosystems":["go"],"tags":["cgo","ci","go","runtime","windows"],"not_affected_if":["no-cgo","prebuilt-binaries-only","trusted-dependencies"],"how_to_check":"- `go version` on build machines and CI runners, to see whether the toolchain is in the affected range (1.27.0 up to 1.27.4)\n- Review third-party or vendored Go dependencies that use cgo on Windows, since those are the packages that would carry a crafted directive","fix":"- Go `1.26.11` for the 1.26 line\n- Go `1.27.4` for the 1.27 line","status":"open","published_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:16+00:00","triaged_at":"2026-11-11T03:38:51+00:00","updated_at":"2026-11-11T03:38:51+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T03:38:51Z","model":"claude-haiku-5-5","output":{"fix":"- Go `1.26.11` for the 1.26 line\n- Go `1.27.4` for the 1.27 line","reach":"local","title":"Go toolchain: crafted package can pass unsafe linker flags during build","impact":"medium","summary":"A malicious Go package can use a crafted cgo_import_dynamic directive or a crafted Windows PE object to inject arguments into the external linker. This can make the linker reference arbitrary files on disk, including through ../ path traversal.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["go","cgo","windows","ci"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Linker reads or references arbitrary files on the build machine","analyst_note":"","how_to_check":"- `go version` on build machines and CI runners, to see whether the toolchain is in the affected range (1.27.0 up to 1.27.4)\n- Review third-party or vendored Go dependencies that use cgo on Windows, since those are the packages that would carry a crafted directive","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-cgo","prebuilt-binaries-only","trusted-dependencies"],"who_is_affected":"Teams that compile Go code, especially on Windows or with cgo enabled, are exposed when they build untrusted or unvetted third-party packages. Teams that only run prebuilt binaries and never compile untrusted Go code are unlikely to be affected by the build-time issue.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000759,"input_tokens":4814,"output_tokens":556,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':18A,21A,24A '-6849':22A '-97042':19A,25A '/go':77C,111C,178C 'addit':125C 'allow':150C 'arbitrari':63B,163C 'argument':52B,94C 'build':71C 'cgo':5A,27B,40B,78C,112C,121C,179C,186C 'cgo-gener':120C,185C 'charact':105C,160C,172C 'check':102C 'ci':28B 'cmd/cgo':13A,128C,196C 'cmd/compile':14A 'cmd/link':16A,130C,198C 'compil':100C,168C 'contain':155C,204C 'could':90C 'craft':39B,46B,85C,152C 'cve':17A,23A 'direct':43B,115C,182C 'disk':66B,166C 'dll':10A,135C,153C,202C 'dynam':7A,42B,80C,114C,181C 'emit':143C 'everi':171C 'extern':55B,97C,148C 'extract':137C 'file':64B,123C,141C,164C,188C 'first':104C 'flag':2A,145C 'generat':122C,187C 'go':20A,29B,34B 'import':6A,41B,79C,113C,134C,180C,201C 'includ':67B,183C 'inject':3A,51B 'l':144C 'lead':208C 'librari':93C,108C,175C 'link':82C 'linker':1A,56B,61B,98C,149C 'make':59B 'malici':33B,73C 'name':11A,109C,136C,154C,176C,203C 'object':49B,87C,140C 'packag':35B,74C 'pass':91C 'path':69B,156C,193C,205C 'pe':9A,48B,86C,139C,200C 'refer':62B,162C 'reject':192C,199C 'runtim':30B 'separ':206C 'skip':117C 'special':159C 'toolchain':26A 'travers':70B,157C,194C 'unsaf':92C 'use':37B,76C 'valid':118C,133C,170C 'via':4A 'window':31B,47B,89C,127C,190C","nicknames":[],"mitigations":[],"who_affected":"Teams that compile Go code, especially on Windows or with cgo enabled, are exposed when they build untrusted or unvetted third-party packages. Teams that only run prebuilt binaries and never compile untrusted Go code are unlikely to be affected by the build-time issue.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["toolchain"],"ptokens":["toolchain"],"labels":["cgo","ci","go","runtime","unknown","windows"],"campaign_type":null,"search_a":"'-2026':18A,21A,24A '-6849':22A '-97042':19A,25A 'cgo':5A 'cmd/cgo':13A 'cmd/compile':14A 'cmd/link':16A 'cve':17A,23A 'dll':10A 'dynam':7A 'flag':2A 'go':20A 'import':6A 'inject':3A 'linker':1A 'name':11A 'pe':9A 'toolchain':26A 'via':4A","search_b":"'arbitrari':63B 'argument':52B 'cgo':27B,40B 'ci':28B 'craft':39B,46B 'direct':43B 'disk':66B 'dynam':42B 'extern':55B 'file':64B 'go':29B,34B 'import':41B 'includ':67B 'inject':51B 'linker':56B,61B 'make':59B 'malici':33B 'object':49B 'packag':35B 'path':69B 'pe':48B 'refer':62B 'runtim':30B 'travers':70B 'use':37B 'window':31B,47B","search_c":"'/go':77C,111C,178C 'addit':125C 'allow':150C 'arbitrari':163C 'argument':94C 'build':71C 'cgo':78C,112C,121C,179C,186C 'cgo-gener':120C,185C 'charact':105C,160C,172C 'check':102C 'cmd/cgo':128C,196C 'cmd/link':130C,198C 'compil':100C,168C 'contain':155C,204C 'could':90C 'craft':85C,152C 'direct':115C,182C 'disk':166C 'dll':135C,153C,202C 'dynam':80C,114C,181C 'emit':143C 'everi':171C 'extern':97C,148C 'extract':137C 'file':123C,141C,164C,188C 'first':104C 'flag':145C 'generat':122C,187C 'import':79C,113C,134C,180C,201C 'includ':183C 'l':144C 'lead':208C 'librari':93C,108C,175C 'link':82C 'linker':98C,149C 'malici':73C 'name':109C,136C,154C,176C,203C 'object':87C,140C 'packag':74C 'pass':91C 'path':156C,193C,205C 'pe':86C,139C,200C 'refer':162C 'reject':192C,199C 'separ':206C 'skip':117C 'special':159C 'travers':157C,194C 'unsaf':92C 'use':76C 'valid':118C,133C,170C 'window':89C,127C,190C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T02:51:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6849","url":"https://pkg.go.dev/vuln/GO-2026-6849","severity":null,"published_at":"2026-11-11T02:51:11+00:00","modified_at":"2026-11-11T02:51:11+00:00","first_seen_at":"2026-11-11T03:37:16+00:00","fetched_at":"2026-11-11T03:37:16+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}