CVE-2026-97033 Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-97033?
CVE-2026-97033 is a vulnerability in cmd/go, published on 11 Nov 2026.
Official description
Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; "-target" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and "-x" permitted specifying arbitrary compiler input languages beyond those supported by cgo. "--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and "-Wl,-syslibroot" are verified not to point to regular files, and "-x" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.
Which versions are affected by CVE-2026-97033?
1 open source package ship an affected version, including toolchain.
| Package | Affected | Fixed in |
|---|---|---|
toolchain Go | All versions | 1.26.11, 1.27.4 |
How do I fix CVE-2026-97033?
Upgrade toolchain to a fixed version for your release line: 1.26.11 or 1.27.4.
Is CVE-2026-97033 being exploited?
There is no known exploitation of CVE-2026-97033 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-97033, DEBIAN-CVE-2026-97033, GHSA-428h-9j26-5fcf, GO-2026-6858, UBUNTU-CVE-2026-97033.