EUVD-2026-123109

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary " in a "cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary...