CVE-2026-97037

The Go toolchain (cmd/go) is vulnerable to linker script injection when building packages that use cgo . A malicious package can use LDFLAGS to pass linker script files to the host linker. Specifically, split -Wl, flags (like -Wl,-rpath) previously accepted bare second arguments, which the compil...