https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 05:05:15 +0000 https://db.gcve.eu/vuln/cve-2026-97038 <p><strong>Affected:</strong> Go toolchain cmd/go</p> <p>Building a malicious package containing &#34;.syso&#34; files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including &#34;.syso&#34; files, direct object or library inputs in &#34;#cgo LDFLAGS&#34;, and libraries in &#34;-L&#34; directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or &#34;.syso&#34; files (or loaded via &#34;-l:&lt;filename&gt;&#34; or &#34;-l&#34; containing path separators), injecting unallowlisted linker flags via PE/COFF &#34;.drectve&#34; sections on Windows or Mach-O &#34;LC_LINKER_OPTION&#34; load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects. The go command now verifies that &#34;.syso&#34; files, direct linker inputs, and libraries in &#34;-L&#34; directories are valid binary objects or archives that do not contain unallowlisted &#34;.drectve&#34; directives, &#34;LC_LINKER_OPTION&#34; load commands, or LTO IR sections, and disallows &#34;-l:&lt;filename&gt;&#34; and &#34;:&#34;, &#34;=&#34;, or path separators in &#34;-l&#34; flags.</p> <p><strong>Affected:</strong> Go toolchain cmd/go</p> <p>Building a malicious package containing &#34;.syso&#34; files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including &#34;.syso&#34; files, direct object or library inputs in &#34;#cgo LDFLAGS&#34;, and libraries in &#34;-L&#34; directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or &#34;.syso&#34; files (or loaded via &#34;-l:&lt;filename&gt;&#34; or &#34;-l&#34; containing path separators), injecting unallowlisted linker flags via PE/COFF &#34;.drectve&#34; sections on Windows or Mach-O &#34;LC_LINKER_OPTION&#34; load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects. The go command now verifies that &#34;.syso&#34; files, direct linker inputs, and libraries in &#34;-L&#34; directories are valid binary objects or archives that do not contain unallowlisted &#34;.drectve&#34; directives, &#34;LC_LINKER_OPTION&#34; load commands, or LTO IR sections, and disallows &#34;-l:&lt;filename&gt;&#34; and &#34;:&#34;, &#34;=&#34;, or path separators in &#34;-l&#34; flags.</p> https://db.gcve.eu/vuln/cve-2026-97038