EUVD-2026-123108

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "cgo LDFLAGS". Split "-Wl," flags that consume a following argument such as "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined" previously accept...

CVE-2026-97037

The Go toolchain (cmd/go) is vulnerable to linker script injection when building packages that use cgo . A malicious package can use LDFLAGS to pass linker script files to the host linker. Specifically, split -Wl, flags (like -Wl,-rpath) previously accepted bare second arguments, which the compil...

CVE-2026-97037: Go toolchain cmd/go: Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script…

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "cgo LDFLAGS". Split "-Wl," flags that consume a following argument such as "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined" previously accept...

PT-2026-144960

Building a malicious package that uses cgo could cause arbitrary code execution at link time by passing linker script files to the host linker via "cgo LDFLAGS". Split "-Wl," flags that consume a following argument such as "-Wl,-rpath", "-Wl,--just-symbols", and "-Wl,-undefined" previously accept...