Go cmd/go <1.26.11, <1.27.4 Arbitrary Exec via cgo LDFLAGS on macOS
CVE-2026-97036 Published on November 11, 2026
Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
Products Associated with CVE-2026-97036
Want to know whenever a new CVE is published for GoLang Go? stack.watch will email you.
Affected Versions
Go toolchain cmd/go:- Before 1.26.11 is affected.
- Version 1.27.0-0 and below 1.27.4 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.