Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".

Source published

11 Nov 2026 03:13:15 UTC

Source modified

11 Nov 2026 03:13:15 UTC

Saved here

11 Nov 2026 04:25:37 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".

Source published

Nov 11, 2026, 3:13:15 AM (timezone not stated)

Source modified

Nov 11, 2026, 3:13:15 AM (timezone not stated)

Saved here

15 Nov 2026 05:33:34 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".

Source published

11 Nov 2026 05:19:58 UTC

Source modified

12 Nov 2026 22:09:39 UTC

Saved here

13 Nov 2026 06:18:20 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".

Source published

11 Nov 2026 02:51:11 UTC

Source modified

11 Nov 2026 03:15:14 UTC

Saved here

11 Nov 2026 04:27:36 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.