Arbitrary Code Execution Vulnerability in Go Language Compiler

CVE-2026-97037

What is CVE-2026-97037?

A vulnerability exists in the Go language compiler that allows for arbitrary code execution through the manipulation of linker script files during the linking phase. By crafting a malicious package utilizing cgo and improperly passing linker flags, an attacker can exploit this weakness. The compiler previously permitted certain linker flags to accept bare arguments, potentially leading to dangerous execution pathways. Recent updates now restrict these flags by requiring a specific prefix, enhancing security against such exploitation, but users are advised to review and update their systems to mitigate risks.

References