CVE-2026-97036

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.

• CWE-88

• https://go.dev/cl/862149
• https://go.dev/issue/82574
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6855

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97030A trusted template author may have previously written a vali…6.1
• CVE-2026-97031Multiple ECH outer extension references are not permitted un…7.5
• CVE-2026-97032HTTP/2 servers could end up crashing due to inadvertently mo…7.5
• CVE-2026-97033Building a malicious package that uses cgo could cause arbit…
• CVE-2026-97034When using GCC, building a malicious package that uses cgo c…
• CVE-2026-97035When using Clang or GCC, building a malicious package that u…
• CVE-2026-97037Building a malicious package that uses cgo could cause arbit…
• CVE-2026-97038Building a malicious package containing ".syso" files or cgo…
• CVE-2026-97039Building a malicious package that uses "#cgo pkg-config:" di…
• CVE-2026-9704A flaw was found in Keycloak. An authenticated user with low…8.8
• CVE-2026-97040Building a package containing a crafted ".syso" file could b…
• CVE-2026-97041Building a malicious package containing "//go:cgo_*" compile…