CVE-2026-97036 | BDVDB-2026-404752 Detail

Go toolchaincmd/go

Description#

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

References#

https://go.dev/cl/862149
https://go.dev/issue/82574
https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
https://pkg.go.dev/vuln/GO-2026-6855

Exploit#

No public exploit known

History#

Version 12026-11-11Record published in the CVE List.