GO-2026-6855Published
Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-97036 · CVE overview and exploitation status
cve-program · CVE-2026-97036
- https://go.dev/cl/862149
- https://go.dev/issue/82574
- https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
- https://pkg.go.dev/vuln/GO-2026-6855
euvd · EUVD-2026-123109
- https://go.dev/cl/862149
- https://go.dev/issue/82574
- https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
- https://pkg.go.dev/vuln/GO-2026-6855
nvd · CVE-2026-97036
- https://go.dev/cl/862149
- https://go.dev/issue/82574
- https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
- https://pkg.go.dev/vuln/GO-2026-6855
osv · GO-2026-6855
Related changes
Linked by CVE identifier- On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments … · Advisory content revised · 13 Nov 2026
- Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go · Newly collected advisory · 11 Nov 2026
- Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go · Newly collected advisory · 11 Nov 2026