Search
Find a vulnerability
Search criteria
6 vulnerabilities found for cmd/link by Go toolchain
CVE-2026-97042 (GCVE-0-2026-97042)
Vulnerability from nvd – Published: 2026-11-11 03:13 – Updated: 2026-11-11 03:13
VLAI
EPSS
VEX
Title
Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link
Summary
Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgo_import_dynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
Severity
No CVSS data available.
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/cgo |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
|
| Go toolchain | cmd/compile |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
|
| Go toolchain | cmd/link |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/cgo",
"product": "cmd/cgo",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/compile",
"product": "cmd/compile",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/link",
"product": "cmd/link",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Building a malicious package that uses \"//go:cgo_import_dynamic\" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in \"//go:cgo_import_dynamic\" directives and skipped validation in cgo-generated files. In addition, on Windows, \"cmd/cgo\" and \"cmd/link\" did not validate imported DLL names extracted from PE object files before emitting \"-l\u003cname\u003e\" flags for the external linker, allowing a crafted DLL name containing \"..\" path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in \"//go:cgo_import_dynamic\" directives (including in cgo-generated files on Windows) and rejects \"..\" path traversal, and \"cmd/cgo\" and \"cmd/link\" reject PE imported DLL names containing path separators, \"..\", \":\", or leading \"-\" or \"@\"."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T03:13:15.060Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/862155"
},
{
"url": "https://go.dev/issue/82568"
},
{
"url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6849"
}
],
"title": "Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-97042",
"datePublished": "2026-11-11T03:13:15.060Z",
"dateReserved": "2026-09-23T23:05:04.987Z",
"dateUpdated": "2026-11-11T03:13:15.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97041 (GCVE-0-2026-97041)
Vulnerability from nvd – Published: 2026-11-11 03:13 – Updated: 2026-11-11 03:13
VLAI
EPSS
VEX
Title
Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link
Summary
Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".
Severity
No CVSS data available.
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/compile |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
|
| Go toolchain | cmd/link |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/compile",
"product": "cmd/compile",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/link",
"product": "cmd/link",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."
}
],
"descriptions": [
{
"lang": "en",
"value": "Building a malicious package containing \"//go:cgo_*\" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in \"//go:cgo_import_dynamic\", \"//go:cgo_export_dynamic\", \"//go:cgo_export_static\", \"//go:cgo_import_static\", and \"//go:cgo_dynamic_linker\" directives, and the linker passed the dynamic linker path using \"-Wl,--dynamic-linker,\u003cpath\u003e\". Furthermore, the two-argument form of \"//go:cgo_import_dynamic\" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading \"@\" could split \"-Wl,--export-dynamic-symbol=\" or \"-Wl,--dynamic-linker,\" into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in \"//go:cgo_*\" symbol and dynamic linker directives, the linker passes \"-Wl,--dynamic-linker=\u003cpath\u003e\", and \"cgo_import_dynamic\" no longer overwrites symbols exported via \"cgo_export_dynamic\" or \"cgo_export_static\"."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T03:13:15.269Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/862154"
},
{
"url": "https://go.dev/issue/82569"
},
{
"url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6850"
}
],
"title": "Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-97041",
"datePublished": "2026-11-11T03:13:15.269Z",
"dateReserved": "2026-09-23T23:05:04.987Z",
"dateUpdated": "2026-11-11T03:13:15.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97040 (GCVE-0-2026-97040)
Vulnerability from nvd – Published: 2026-11-11 03:13 – Updated: 2026-11-11 03:13
VLAI
EPSS
VEX
Title
Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link
Summary
Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A ".syso" file beginning with a "go object" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as "cgo_ldflag" or "cgo_dynamic_linker") embedded in the ".syso" file to be passed to the external linker without validation. Additionally, ".syso" filenames longer than 16 bytes lost their ".syso" extension when truncated in archive headers, and unrecognized ".syso" formats forced external linking in pure-Go builds. The linker now rejects ".syso" files that are not recognized host object formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating long archive member names.
Severity
No CVSS data available.
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/go |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
|
| Go toolchain | cmd/link |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/go",
"product": "cmd/go",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/link",
"product": "cmd/link",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."
}
],
"descriptions": [
{
"lang": "en",
"value": "Building a package containing a crafted \".syso\" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading \".syso\" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A \".syso\" file beginning with a \"go object\" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as \"cgo_ldflag\" or \"cgo_dynamic_linker\") embedded in the \".syso\" file to be passed to the external linker without validation. Additionally, \".syso\" filenames longer than 16 bytes lost their \".syso\" extension when truncated in archive headers, and unrecognized \".syso\" formats forced external linking in pure-Go builds. The linker now rejects \".syso\" files that are not recognized host object formats, and \"cmd/go\" and \"cmd/pack\" preserve the \".syso\" suffix when truncating long archive member names."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T03:13:15.477Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/862153"
},
{
"url": "https://go.dev/issue/82570"
},
{
"url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6851"
}
],
"title": "Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-97040",
"datePublished": "2026-11-11T03:13:15.477Z",
"dateReserved": "2026-09-23T23:05:04.987Z",
"dateUpdated": "2026-11-11T03:13:15.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97040 (GCVE-0-2026-97040)
Vulnerability from cvelistv5 – Published: 2026-11-11 03:13 – Updated: 2026-11-11 03:13
VLAI
EPSS
VEX
Title
Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link
Summary
Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A ".syso" file beginning with a "go object" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as "cgo_ldflag" or "cgo_dynamic_linker") embedded in the ".syso" file to be passed to the external linker without validation. Additionally, ".syso" filenames longer than 16 bytes lost their ".syso" extension when truncated in archive headers, and unrecognized ".syso" formats forced external linking in pure-Go builds. The linker now rejects ".syso" files that are not recognized host object formats, and "cmd/go" and "cmd/pack" preserve the ".syso" suffix when truncating long archive member names.
Severity
No CVSS data available.
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/go |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
|
| Go toolchain | cmd/link |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/go",
"product": "cmd/go",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/link",
"product": "cmd/link",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."
}
],
"descriptions": [
{
"lang": "en",
"value": "Building a package containing a crafted \".syso\" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading \".syso\" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O, PE, and XCOFF) before falling through to Go object parsing. A \".syso\" file beginning with a \"go object\" header was parsed as a Go compiler object, allowing untrusted cgo metadata directives (such as \"cgo_ldflag\" or \"cgo_dynamic_linker\") embedded in the \".syso\" file to be passed to the external linker without validation. Additionally, \".syso\" filenames longer than 16 bytes lost their \".syso\" extension when truncated in archive headers, and unrecognized \".syso\" formats forced external linking in pure-Go builds. The linker now rejects \".syso\" files that are not recognized host object formats, and \"cmd/go\" and \"cmd/pack\" preserve the \".syso\" suffix when truncating long archive member names."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T03:13:15.477Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/862153"
},
{
"url": "https://go.dev/issue/82570"
},
{
"url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6851"
}
],
"title": "Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-97040",
"datePublished": "2026-11-11T03:13:15.477Z",
"dateReserved": "2026-09-23T23:05:04.987Z",
"dateUpdated": "2026-11-11T03:13:15.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97041 (GCVE-0-2026-97041)
Vulnerability from cvelistv5 – Published: 2026-11-11 03:13 – Updated: 2026-11-11 03:13
VLAI
EPSS
VEX
Title
Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link
Summary
Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".
Severity
No CVSS data available.
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/compile |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
|
| Go toolchain | cmd/link |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/compile",
"product": "cmd/compile",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/link",
"product": "cmd/link",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "RyotaK (https://ryotak.net) of GMO Flatt Security Inc."
}
],
"descriptions": [
{
"lang": "en",
"value": "Building a malicious package containing \"//go:cgo_*\" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in \"//go:cgo_import_dynamic\", \"//go:cgo_export_dynamic\", \"//go:cgo_export_static\", \"//go:cgo_import_static\", and \"//go:cgo_dynamic_linker\" directives, and the linker passed the dynamic linker path using \"-Wl,--dynamic-linker,\u003cpath\u003e\". Furthermore, the two-argument form of \"//go:cgo_import_dynamic\" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading \"@\" could split \"-Wl,--export-dynamic-symbol=\" or \"-Wl,--dynamic-linker,\" into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in \"//go:cgo_*\" symbol and dynamic linker directives, the linker passes \"-Wl,--dynamic-linker=\u003cpath\u003e\", and \"cgo_import_dynamic\" no longer overwrites symbols exported via \"cgo_export_dynamic\" or \"cgo_export_static\"."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T03:13:15.269Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/862154"
},
{
"url": "https://go.dev/issue/82569"
},
{
"url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6850"
}
],
"title": "Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-97041",
"datePublished": "2026-11-11T03:13:15.269Z",
"dateReserved": "2026-09-23T23:05:04.987Z",
"dateUpdated": "2026-11-11T03:13:15.269Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97042 (GCVE-0-2026-97042)
Vulnerability from cvelistv5 – Published: 2026-11-11 03:13 – Updated: 2026-11-11 03:13
VLAI
EPSS
VEX
Title
Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link
Summary
Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgo_import_dynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
Severity
No CVSS data available.
CWE
- CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Assigner
References
Impacted products
3 products
| Vendor | Product | Version | |
|---|---|---|---|
| Go toolchain | cmd/cgo |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
|
| Go toolchain | cmd/compile |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
|
| Go toolchain | cmd/link |
Affected:
0 , < 1.26.11
(semver)
Affected: 1.27.0-0 , < 1.27.4 (semver) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/cgo",
"product": "cmd/cgo",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/compile",
"product": "cmd/compile",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "cmd/link",
"product": "cmd/link",
"vendor": "Go toolchain",
"versions": [
{
"lessThan": "1.26.11",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "1.27.4",
"status": "affected",
"version": "1.27.0-0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Building a malicious package that uses \"//go:cgo_import_dynamic\" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in \"//go:cgo_import_dynamic\" directives and skipped validation in cgo-generated files. In addition, on Windows, \"cmd/cgo\" and \"cmd/link\" did not validate imported DLL names extracted from PE object files before emitting \"-l\u003cname\u003e\" flags for the external linker, allowing a crafted DLL name containing \"..\" path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in \"//go:cgo_import_dynamic\" directives (including in cgo-generated files on Windows) and rejects \"..\" path traversal, and \"cmd/cgo\" and \"cmd/link\" reject PE imported DLL names containing path separators, \"..\", \":\", or leading \"-\" or \"@\"."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-11T03:13:15.060Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/862155"
},
{
"url": "https://go.dev/issue/82568"
},
{
"url": "https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-6849"
}
],
"title": "Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-97042",
"datePublished": "2026-11-11T03:13:15.060Z",
"dateReserved": "2026-09-23T23:05:04.987Z",
"dateUpdated": "2026-11-11T03:13:15.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}