CVE-2026-97033

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified)

Description Building a malicious package using cgo can lead to arbitrary code execution during the build process via specific compiler and linker flags in #cgo directives. The issue involves several mechanisms: the --sysroot flag in GCC and Clang allows relocating compiler subprograms and CRT startup objects to an attacker-controlled directory; the -target flag in Clang may execute helper tools from the current working directory if not found in the PATH; the -isysroot and -Wl,-syslibroot flags can pass a regular file to GNU ld.bfd, which is then interpreted as a positional linker script; and the -x flag allows the specification of arbitrary compiler input languages not supported by cgo.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.