Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-97039 · CVE overview and exploitation status

EUVD-2026-123106

GHSA-4x3g-87c5-vq62

GO-2026-6852

cve-program · CVE-2026-97039

• https://go.dev/cl/862152
• https://go.dev/issue/82571
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6852

euvd · EUVD-2026-123106

• https://go.dev/cl/862152
• https://go.dev/issue/82571
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6852

nvd · CVE-2026-97039

• https://go.dev/cl/862152
• https://go.dev/issue/82571
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6852

osv · GO-2026-6852

• https://go.dev/cl/862152
• https://go.dev/issue/82571
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM

• Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--perso… · Advisory content revised · 15 Nov 2026
• Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--perso… · Advisory content revised · 13 Nov 2026
• Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go · Newly collected advisory · 11 Nov 2026
• Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go · Newly collected advisory · 11 Nov 2026