CVE-2026-97041

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description Building a malicious package containing //go:cgo * compiler directives can allow the injection of arbitrary flags into the external linker invocation on ELF platforms. This occurs because the compiler and linker failed to reject commas in the //go:cgo import dynamic, //go:cgo export dynamic, //go:cgo export static, //go:cgo import static, and //go:cgo dynamic linker directives. Additionally, the two-argument form of //go:cgo import dynamic could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or a leading @ could split the -Wl,--export-dynamic-symbol= or -Wl,--dynamic-linker, arguments into arbitrary host linker flags or response file arguments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.