Code Execution Vulnerability in Go Compiler Toolchain by Google

CVE-2026-97035

What is CVE-2026-97035?

A vulnerability in the Go Compiler Toolchain enables malicious packages using cgo to execute unexpected code during the build process. Utilizing compiler flags such as '-gen-' or '-gnat' in '#cgo' directives can lead to arbitrary file writes or code execution at build time. This flaw arises due to improper validation of positional inputs passed to the linker, allowing the exploitation of the flags '-gen-cdb-fragment-path ' (Clang) and '-gnatO ' (GCC), resulting in potential security risks. The disallowance of these flags in '#cgo' directives is essential for mitigating the vulnerability.

References