CVE-2026-97038: Go toolchain cmd/go: Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or…

Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "cgo LDFLAGS", and libraries in "-L" directories—were passed to the...