https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 13 Nov 2026 04:02:43 +0000 https://db.gcve.eu/vuln/cve-2026-97033 <p><strong>Affected:</strong> Go toolchain cmd/go</p> <p>Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in &#34;#cgo&#34; directives. Specifically, &#34;--sysroot&#34; in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; &#34;-target&#34; in Clang falls back to executing target helper tools from the current working directory when not found in PATH; &#34;-isysroot&#34; and &#34;-Wl,-syslibroot&#34; can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and &#34;-x&#34; permitted specifying arbitrary compiler input languages beyond those supported by cgo. &#34;--sysroot&#34; and &#34;-target&#34; are now disallowed in &#34;#cgo&#34; flags, &#34;-isysroot&#34; and &#34;-Wl,-syslibroot&#34; are verified not to point to regular files, and &#34;-x&#34; is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.</p> <p><strong>Affected:</strong> Go toolchain cmd/go</p> <p>Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in &#34;#cgo&#34; directives. Specifically, &#34;--sysroot&#34; in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; &#34;-target&#34; in Clang falls back to executing target helper tools from the current working directory when not found in PATH; &#34;-isysroot&#34; and &#34;-Wl,-syslibroot&#34; can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and &#34;-x&#34; permitted specifying arbitrary compiler input languages beyond those supported by cgo. &#34;--sysroot&#34; and &#34;-target&#34; are now disallowed in &#34;#cgo&#34; flags, &#34;-isysroot&#34; and &#34;-Wl,-syslibroot&#34; are verified not to point to regular files, and &#34;-x&#34; is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.</p> https://db.gcve.eu/vuln/cve-2026-97033