GO-2026-6857
- Source
- https://pkg.go.dev/vuln/GO-2026-6857
- Import Source
- https://vuln.go.dev/ID/GO-2026-6857.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-6857
- Aliases
-
- CVE-2026-97034
- Published
- 2026-11-11T02:51:11Z
- Modified
- 2026-11-11T03:15:14Z
- Summary
- Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go
- Details
-
When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or "*.spec").
When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib*".
The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.
- Database specific
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-6857" }- References
Affected packages
Go / toolchain
Package
- Name
- toolchain
- View open source insights on deps.dev
- Purl
- pkg:golang/toolchain