CVE-2026-97039
Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
Exploit likelihood
What each source reports
CVE ListNo score
Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
- Record
CVE-2026-97039- Updated
- 2026-11-11
EUVDEUVD-2026-123106No score
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
- Record
EUVD-2026-123106- Updated
- 2026-11-11
GitHub AdvisoriesGHSA-4x3g-87c5-vq62No score
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg...
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
- Record
GHSA-4x3g-87c5-vq62- Updated
- 2026-11-11
NVDNo score
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
- Record
CVE-2026-97039- Updated
- 2026-11-11
OSVDEBIAN-CVE-2026-97039No score
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
- Record
DEBIAN-CVE-2026-97039- Updated
- 2026-11-11
OSVGO-2026-6852No score
Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags.
The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe.
The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
- Record
GO-2026-6852- Updated
- 2026-11-11
OSVopenSUSE-SU-2026:12529-1No score
go1.26-1.26.11-1.1 on GA media
These are all security issues fixed in the go1.26-1.26.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12529-1- Updated
- 2026-11-12
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
golang-1.19Debian:12 | All versions, plus listed versions 1.19.10-11.19.10-21.19.11-11.19.12-11.19.12-2 Show 7 moreShow less1.19.12-2~bpo11+11.19.12-2~bpo12+11.19.13-11.19.13-1~bpo11+11.19.13-1~bpo12+11.19.8-21.19.9-1 | None known |
golang-1.24Debian:13 | All versions, plus listed versions 1.24.12-11.24.13-11.24.13-21.24.4-11.24.4-2 Show 5 moreShow less1.24.4-31.24.4-41.24.7-11.24.8-11.24.9-1 | None known |
golang-1.26Debian:14 | All versions, plus listed versions 1.26.0-11.26.1-11.26.10-11.26.10-1~bpo13+11.26.11-1 Show 23 moreShow less1.26.2-11.26.2-21.26.2-31.26.3-11.26.3-1~bpo13+11.26.3-21.26.3-2~bpo13+11.26.4-11.26.4-1~bpo13+11.26.5-11.26.5-1~bpo13+11.26.6-11.26.6-21.26.7-11.26.7-1~bpo13+11.26.8-11.26.8-1~bpo13+11.26.8-21.26.9-11.26.9-1~bpo13+11.26~rc2-11.26~rc3-11.26~rc3-2 | None known |
golang-1.27Debian:14 | All versions, plus listed versions 1.27.0-11.27.0-1~bpo13+11.27.1-11.27.1-21.27.1-2~bpo13+1 Show 9 moreShow less1.27.2-11.27.2-1~bpo13+11.27.2-1~bpo13+21.27.3-11.27.3-1~bpo13+11.27.4-11.27~rc1-11.27~rc2-11.27~rc3-1 | None known |
toolchainGo | before 1.26.11, 1.27.0-0 up to 1.27.4 | 1.26.111.27.4 |
go1.26openSUSE:Tumbleweed From an advisory covering 12 CVEs | before 1.26.11-1.1 | 1.26.11-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, published, references | EUVD, OSV | |
| published | EUVD, NVD, OSV | |
| aliases, references | GitHub Advisories | |
| affected | OSV | |
| aliases | EUVD | |
| description, products, references | CVE List | |
| affected, aliases, description, facts, references, title | OSV | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-97039 is a vulnerability with no CVSS score yet in Go Toolchain Cmd/go, published November 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 14th percentile. Fixed in toolchain 1.26.11.
References
go.dev/cl/862152
groups.google.com/g/golang-announce/c/iY8TY0wWgbM
pkg.go.dev/vuln/GO-2026-6852
nvd.nist.gov/vuln/detail/CVE-2026-97039
github.com/advisories/GHSA-4x3g-87c5-vq62
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2026-97039
suse.com/security/cve/CVE-2026-97033