Arbitrary Flag Injection Vulnerability in Go Compiler and Linker

CVE-2026-97041

What is CVE-2026-97041?

An injection vulnerability exists in the Go compiler and linker which allows for the creation of a malicious package that can include specific compiler directives. These directives may introduce arbitrary flags during external linker invocations on ELF platforms. Specifically, the directives associated with cgo imports and exports fail to properly validate comma inclusions, potentially causing unintended alterations in dynamic linker paths and symbol references. Recent updates rectify this flaw by enforcing stricter checks, ensuring that commas within these directives are rejected, thus preventing the misuse of the two-argument form of certain cgo commands that could overwrite previously marked symbols.

References