CVE-2026-97037

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description Building a malicious package using cgo can lead to arbitrary code execution during link time. This occurs when linker script files are passed to the host linker through the #cgo LDFLAGS directive. Specifically, certain split -Wl, flags that require a subsequent argument, such as -Wl,-rpath, -Wl,--just-symbols, and -Wl,-undefined, previously allowed a second argument without the -Wl, prefix. The compiler driver would then pass this argument directly to the linker as a positional input file. Furthermore, when utilizing GNU ld.bfd, flags including -framework, -Wl,-framework, -Wl,-undefined, -Wl,--just-symbols, -Wl,-R, -Wl,-subsystem, and -Wl,-sectcreate (on non-Darwin platforms) could cause ld.bfd to treat their arguments as linker scripts if they corresponded to a regular file on disk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.