GO-2026-6850

See a problem?
Please try reporting it to the source first.

Source

https://pkg.go.dev/vuln/GO-2026-6850

Import Source

https://vuln.go.dev/ID/GO-2026-6850.json

JSON Data

https://api.osv.dev/v1/vulns/GO-2026-6850

Aliases

CVE-2026-97041

Published

2026-11-11T02:51:11Z

Modified

2026-11-11T03:15:14Z

Summary

Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link

Details

Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms.

The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments.

The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".

Database specific

{
    "review_status": "REVIEWED",
    "url": "https://pkg.go.dev/vuln/GO-2026-6850"
}

References

Credits

- RyotaK (https://ryotak.net) of GMO Flatt Security Inc.

Affected packages

Go / toolchain

Package

Name: toolchain; View open source insights on deps.dev
Purl: pkg:golang/toolchain

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.11

Introduced

1.27.0-0

Fixed

1.27.4

Ecosystem specific

{
    "imports": [
        {
            "path": "cmd/compile"
        },
        {
            "path": "cmd/link"
        }
    ]
}

Database specific

source

"https://vuln.go.dev/ID/GO-2026-6850.json"