---
id: "CVE-2026-97042"
page: "https://infrastack.ai/live/CVE-2026-97042"
kind: "vulnerability"
aliases: ["CVE-2026-97042", "GO-2026-6849"]
title: "Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "toolchain", "fixed": ["1.26.11", "1.27.4"], "affected": ">= 1.27.0-0, < 1.27.4", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cgo", "ci", "go", "runtime", "windows"]
not_affected_if: ["no-cgo", "prebuilt-binaries-only", "trusted-dependencies"]
published_at: "2026-11-11T02:51:11+00:00"
first_seen_at: "2026-11-11T03:37:16+00:00"
updated_at: "2026-11-11T03:38:51+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6849", "first_seen_at": "2026-11-11T03:37:16+00:00"}]
exploit_sources: []
---

# Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link

Link for people: https://infrastack.ai/live/CVE-2026-97042 (this .md is for agents)

A malicious Go package can use a crafted cgo_import_dynamic directive or a crafted Windows PE object to inject arguments into the external linker. This can make the linker reference arbitrary files on disk, including through ../ path traversal.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:toolchain affected >= 1.27.0-0, < 1.27.4 fixed 1.26.11, 1.27.4

## How to check

- `go version` on build machines and CI runners, to see whether the toolchain is in the affected range (1.27.0 up to 1.27.4)
- Review third-party or vendored Go dependencies that use cgo on Windows, since those are the packages that would carry a crafted directive

## Fix

- Go `1.26.11` for the 1.26 line
- Go `1.27.4` for the 1.27 line

## Timeline

- 2026-11-11T03:37:16+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6849

## From the sources

Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker.

The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk.

The compiler now validates every character of the library name in "//go:cgo_import_dynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_