CVE-2026-97043

Name of the Vulnerable Software and Affected Versions Go (affected versions not specified)

Description Building a malicious package using cgo can bypass #cgo LDFLAGS validation, potentially leading to unexpected code execution during build time or causing the go command to panic. This occurs due to crafted quoting in //go:cgo ldflag directives. Specifically, cmd/cgo quotes #cgo LDFLAGS arguments using strconv.Quote, but cmd/compile and cmd/go parse these directives by splitting on raw quote characters without handling backslash escapes or unquoting the string. This discrepancy allows disallowed linker flags or unvalidated linker search paths to bypass flag checks and reach the external linker. Additionally, deduplicating LDFLAGS in the go command can trigger a panic with an out-of-bounds slice index in the processCgoOutputs() function when a prefix of the flag list matches near the end of the slice.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.