CVE-2026-97036
Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
Exploit likelihood
What each source reports
CVE ListNo score
Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
- Record
CVE-2026-97036- Updated
- 2026-11-11
EUVDEUVD-2026-123109No score
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
- Record
EUVD-2026-123109- Updated
- 2026-11-11
GitHub AdvisoriesGHSA-qxq7-88pj-2ph7No score
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when...
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
- Record
GHSA-qxq7-88pj-2ph7- Updated
- 2026-11-11
NVDNo score
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
- Record
CVE-2026-97036- Updated
- 2026-11-11
OSVDEBIAN-CVE-2026-97036No score
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
- Record
DEBIAN-CVE-2026-97036- Updated
- 2026-11-11
OSVGO-2026-6855No score
Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive.
The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time.
The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
- Record
GO-2026-6855- Updated
- 2026-11-11
OSVopenSUSE-SU-2026:12529-1No score
go1.26-1.26.11-1.1 on GA media
These are all security issues fixed in the go1.26-1.26.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12529-1- Updated
- 2026-11-12
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
golang-1.19Debian:12 | All versions, plus listed versions 1.19.10-11.19.10-21.19.11-11.19.12-11.19.12-2 Show 7 moreShow less1.19.12-2~bpo11+11.19.12-2~bpo12+11.19.13-11.19.13-1~bpo11+11.19.13-1~bpo12+11.19.8-21.19.9-1 | None known |
golang-1.24Debian:13 | All versions, plus listed versions 1.24.12-11.24.13-11.24.13-21.24.4-11.24.4-2 Show 5 moreShow less1.24.4-31.24.4-41.24.7-11.24.8-11.24.9-1 | None known |
golang-1.26Debian:14 | All versions, plus listed versions 1.26.0-11.26.1-11.26.10-11.26.10-1~bpo13+11.26.11-1 Show 23 moreShow less1.26.2-11.26.2-21.26.2-31.26.3-11.26.3-1~bpo13+11.26.3-21.26.3-2~bpo13+11.26.4-11.26.4-1~bpo13+11.26.5-11.26.5-1~bpo13+11.26.6-11.26.6-21.26.7-11.26.7-1~bpo13+11.26.8-11.26.8-1~bpo13+11.26.8-21.26.9-11.26.9-1~bpo13+11.26~rc2-11.26~rc3-11.26~rc3-2 | None known |
golang-1.27Debian:14 | All versions, plus listed versions 1.27.0-11.27.0-1~bpo13+11.27.1-11.27.1-21.27.1-2~bpo13+1 Show 9 moreShow less1.27.2-11.27.2-1~bpo13+11.27.2-1~bpo13+21.27.3-11.27.3-1~bpo13+11.27.4-11.27~rc1-11.27~rc2-11.27~rc3-1 | None known |
toolchainGo | before 1.26.11, 1.27.0-0 up to 1.27.4 | 1.26.111.27.4 |
go1.26openSUSE:Tumbleweed From an advisory covering 12 CVEs | before 1.26.11-1.1 | 1.26.11-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, published, references | EUVD, OSV | |
| published | EUVD, NVD, OSV | |
| aliases, references | GitHub Advisories | |
| affected | OSV | |
| aliases | EUVD | |
| description, products, references | CVE List | |
| affected, aliases, description, facts, references, title | OSV | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97036 is a vulnerability with no CVSS score yet in Go Toolchain Cmd/go, published November 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in toolchain 1.26.11.
References
go.dev/cl/862149
groups.google.com/g/golang-announce/c/iY8TY0wWgbM
pkg.go.dev/vuln/GO-2026-6855
nvd.nist.gov/vuln/detail/CVE-2026-97036
github.com/advisories/GHSA-qxq7-88pj-2ph7
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2026-97036
suse.com/security/cve/CVE-2026-97033