GO-2026-6852
- Source
- https://pkg.go.dev/vuln/GO-2026-6852
- Import Source
- https://vuln.go.dev/ID/GO-2026-6852.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-6852
- Aliases
-
- CVE-2026-97039
- Published
- 2026-11-11T02:51:11Z
- Modified
- 2026-11-11T03:15:14Z
- Summary
- Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go
- Details
-
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags.
The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe.
The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
- Database specific
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2026-6852" }- References
Affected packages
Go / toolchain
Package
- Name
- toolchain
- View open source insights on deps.dev
- Purl
- pkg:golang/toolchain