Arbitrary Code Execution Risk in Go Programming Language via Malicious Package

CVE-2026-97033

What is CVE-2026-97033?

A security flaw in the Go programming language enabled attackers to execute arbitrary code at build time by crafting malicious packages that utilized specific '#cgo' directives. Notably, flags such as '--sysroot' and '-target' could mislead the compiler to execute subprograms from uncontrolled directories, while other options allowed regular files to be interpreted as linker scripts. Recent updates have restricted these flags, enhancing protection against misuse and ensuring verification against potential threats.

References