PT-2026-144965

Building a malicious package that uses "//go:cgo import dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo import dynamic" directives and skipped...

CVE-2026-97042: Go toolchain: Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could…

Building a malicious package that uses "//go:cgoimportdynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgoimportdynamic" directives and skipped validation...

CVE-2026-97041: Go toolchain: Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external…

Building a malicious package containing "//go:cgo" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgoimportdynamic", "//go:cgoexportdynamic", "//go:cgoexportstatic",...