CVE-2026-97039

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description Building a malicious package using #cgo pkg-config: directives can lead to the loading of untrusted pkg-config .pc files or the injection of unvalidated compiler and linker flags. This occurs because the pkg-config flag allowlist previously permitted --with-path= and --personality=, and allowed --define-variable= values starting with = or $, which could rewrite system .pc file paths into sysroot-prefixed linker search paths. Additionally, package arguments ending in .pc or containing path separators or .. allowed pkg-config to load local .pc files directly from the package directory. Furthermore, flags returned by pkg-config --cflags in cgoCPPFLAGS were not verified when determining the safety of internal linking.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.