https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 05:03:31 +0000 https://db.gcve.eu/vuln/cve-2026-97039 <p><strong>Affected:</strong> Go toolchain cmd/go</p> <p>Building a malicious package that uses &#34;#cgo pkg-config:&#34; directives could load untrusted pkg-config &#34;.pc&#34; files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted &#34;--with-path=&#34; and &#34;--personality=&#34;, allowed &#34;--define-variable=&#34; values beginning with &#34;=&#34; or &#34;$&#34; (which can rewrite paths in system &#34;.pc&#34; files into sysroot-prefixed &#34;-L=&#34; or &#34;-L$SYSROOT&#34; linker search paths), and allowed package arguments ending in &#34;.pc&#34; or containing path separators or &#34;..&#34;, which caused pkg-config to load local &#34;.pc&#34; files directly from the package directory. In addition, flags returned by &#34;pkg-config --cflags&#34; in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows &#34;--with-path=&#34;, &#34;--personality=&#34;, leading &#34;=&#34; or &#34;$&#34; characters in &#34;--define-variable=&#34; values, and local &#34;.pc&#34; paths in &#34;#cgo pkg-config:&#34; directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.</p> <p><strong>Affected:</strong> Go toolchain cmd/go</p> <p>Building a malicious package that uses &#34;#cgo pkg-config:&#34; directives could load untrusted pkg-config &#34;.pc&#34; files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted &#34;--with-path=&#34; and &#34;--personality=&#34;, allowed &#34;--define-variable=&#34; values beginning with &#34;=&#34; or &#34;$&#34; (which can rewrite paths in system &#34;.pc&#34; files into sysroot-prefixed &#34;-L=&#34; or &#34;-L$SYSROOT&#34; linker search paths), and allowed package arguments ending in &#34;.pc&#34; or containing path separators or &#34;..&#34;, which caused pkg-config to load local &#34;.pc&#34; files directly from the package directory. In addition, flags returned by &#34;pkg-config --cflags&#34; in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows &#34;--with-path=&#34;, &#34;--personality=&#34;, leading &#34;=&#34; or &#34;$&#34; characters in &#34;--define-variable=&#34; values, and local &#34;.pc&#34; paths in &#34;#cgo pkg-config:&#34; directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.</p> https://db.gcve.eu/vuln/cve-2026-97039