GO-2026-6855

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6855

Import Source

https://vuln.go.dev/ID/GO-2026-6855.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6855

Aliases

CVE-2026-97036

Published

2026-11-11T02:51:11Z

Modified

2026-11-11T03:15:15Z

Summary

Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

Details

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library " in a "#cgo LDFLAGS" directive.

The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time.

The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6855"
}

References

Credits

- Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/)

Affected packages

Go / toolchain

Package

Name: toolchain; View open source insights on deps.dev
Purl: pkg:golang/toolchain

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.11

Introduced

1.27.0-0

Fixed

1.27.4

Ecosystem specific

{
    "imports": [
        {
            "goos": [
                "darwin"
            ],
            "path": "cmd/go"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6855.json"