CVE-2026-97035

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description Building a malicious package using cgo with Clang or GCC can lead to unexpected code execution during build time or the creation of files in arbitrary directories. This occurs because the -g* wildcard in the compiler and linker flag allowlists previously permitted Clang's -gen-cdb-fragment-path <dir> and GCC's -gnatO <file> flags. This allows compilation database fragments and sidecar output files to be written to unauthorized locations and desynchronizes flag argument parsing between the go command and the compiler driver, potentially allowing subsequent arguments to be passed as unvalidated positional inputs to the linker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.