Arbitrary Code Execution Vulnerability in Go Programming Language

CVE-2026-97038

What is CVE-2026-97038?

A vulnerability in the Go programming language allows attackers to create malicious packages containing '.syso' files or cgo linker inputs. This flaw enables the injection of arbitrary linker flags and the execution of arbitrary code during the linking process. The issue arises from the passing of linker input files, which lack proper validation of their format and content. This oversight opens doors for executing malicious GNU ld implicit linker scripts disguised as libraries. The Go team has implemented enhancements to ensure that all linker inputs are validated, disallowing unsafe directives that could lead to significant security breaches.

References