CVE-2026-97036 Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary " in a "cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary...