Injection Vulnerability in Go's pkg-config Management

CVE-2026-97039

What is CVE-2026-97039?

A vulnerability exists in the Go programming language's handling of pkg-config directives, which could allow for malicious packages to load untrusted '.pc' files or introduce unvalidated compiler and linker flags. The previously permitted pkg-config flag 'allowlist' could lead to security risks as it allowed for inappropriate configurations, leading to potential exploitation through local '.pc' files. Recent updates have introduced stricter controls, disallowing specific flags and ensuring that cgoCPPFLAGS are scrutinized for internal linking safety, thereby enhancing overall security.

References