EUVD-2026-123104Published
Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-97041 · CVE overview and exploitation status
cve-program · CVE-2026-97041
- https://go.dev/cl/862154
- https://go.dev/issue/82569
- https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
- https://pkg.go.dev/vuln/GO-2026-6850
euvd · EUVD-2026-123104
- https://go.dev/cl/862154
- https://go.dev/issue/82569
- https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
- https://pkg.go.dev/vuln/GO-2026-6850
nvd · CVE-2026-97041
- https://go.dev/cl/862154
- https://go.dev/issue/82569
- https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
- https://pkg.go.dev/vuln/GO-2026-6850
osv · GO-2026-6850
Related changes
Linked by CVE identifier- Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cg… · Advisory content revised · 15 Nov 2026
- Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cg… · Advisory content revised · 13 Nov 2026
- Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link · Newly collected advisory · 11 Nov 2026
- Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link · Newly collected advisory · 11 Nov 2026