CVE-2026-97039 Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-97039?
CVE-2026-97039 is a vulnerability in cmd/go, published on 11 Nov 2026.
Official description
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
Which versions are affected by CVE-2026-97039?
1 open source package ship an affected version, including toolchain.
| Package | Affected | Fixed in |
|---|---|---|
toolchain Go | All versions | 1.26.11, 1.27.4 |
How do I fix CVE-2026-97039?
Upgrade toolchain to a fixed version for your release line: 1.26.11 or 1.27.4.
Is CVE-2026-97039 being exploited?
There is no known exploitation of CVE-2026-97039 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-97039, DEBIAN-CVE-2026-97039, GHSA-4x3g-87c5-vq62, GO-2026-6852, UBUNTU-CVE-2026-97039.