CVE-2026-97036 Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-97036?
CVE-2026-97036 is a vulnerability in cmd/go, published on 11 Nov 2026.
Official description
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
Which versions are affected by CVE-2026-97036?
1 open source package ship an affected version, including toolchain.
| Package | Affected | Fixed in |
|---|---|---|
toolchain Go | All versions | 1.26.11, 1.27.4 |
How do I fix CVE-2026-97036?
Upgrade toolchain to a fixed version for your release line: 1.26.11 or 1.27.4.
Is CVE-2026-97036 being exploited?
There is no known exploitation of CVE-2026-97036 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-97036, GHSA-qxq7-88pj-2ph7, GO-2026-6855, UBUNTU-CVE-2026-97036.