Skip to content
Fencer Intel
no cvss —

CVE-2026-97036 json

Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

published yesterday modified yesterday also EUVD-2026-123109 , GO-2026-6855

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 16%
public exploits
0
none known

Summary

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.

Patch / fix

  • go toolchain 1.26.11, 1.27.4
  • Go toolchain cmd/go 1.26.11, 1.27.4

Is CVE-2026-97036 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-11).

Affected packages

ecosystem package affected fixed in
go toolchain
<1.26.11
>=1.27.0-0, <1.27.4
1.26.11
1.27.4

Affected products

  • Go toolchain cmd/go

Classification

Weakness
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.