CVE-2026-97039

Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.

• CWE-88

• https://go.dev/cl/862152
• https://go.dev/issue/82571
• https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM
• https://pkg.go.dev/vuln/GO-2026-6852

Published

Nov 11, 2026

Last Modified

Nov 12, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97033Building a malicious package that uses cgo could cause arbit…
• CVE-2026-97034When using GCC, building a malicious package that uses cgo c…
• CVE-2026-97035When using Clang or GCC, building a malicious package that u…
• CVE-2026-97036On Darwin, building a malicious package that uses cgo could …
• CVE-2026-97037Building a malicious package that uses cgo could cause arbit…
• CVE-2026-97038Building a malicious package containing ".syso" files or cgo…
• CVE-2026-9704A flaw was found in Keycloak. An authenticated user with low…8.8
• CVE-2026-97040Building a package containing a crafted ".syso" file could b…
• CVE-2026-97041Building a malicious package containing "//go:cgo_*" compile…
• CVE-2026-97042Building a malicious package that uses "//go:cgo_import_dyna…
• CVE-2026-97043Building a malicious package that uses cgo could bypass "#cg…
• CVE-2026-97045In childTextNodesAreLiteral, walking up the tree previously …6.1