CVE-2026-97033 is a command injection vulnerability in the Go toolchain's cmd/go component related to the handling of cgo compiler and linker flags. Malicious packages using cgo could exploit certain flags to execute arbitrary code during build time. The vulnerability arises from unsafe use of flags such as --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x in #cgo directives. The Go project has mitigated this by disallowing or restricting these flags and verifying their usage. Fixed versions are 1.26.11 and 1.27.4.
CVE-2026-97034 is a command injection vulnerability in the Go toolchain's cmd/go component when using GCC and cgo. It arises during the linking phase if malicious GCC spec files are present, potentially allowing arbitrary command execution. The vulnerability involves unsafe evaluation of GCC link specs when certain compiler flags like -fopenmp, -fopenacc, or -fsanitize= are used. The Go toolchain has been updated to reject directories containing GCC spec files and disallow certain flag prefixes to mitigate this risk.
CVE-2026-97035 is an argument injection vulnerability in the Go toolchain's cmd/go component affecting versions before 1.26.11 and between 1.27.0-0 and 1.27.4. It arises when building malicious packages using cgo with Clang or GCC compilers. The vulnerability allows unexpected code execution at build time or writing files to arbitrary directories via certain compiler and linker flags in #cgo directives. The issue stems from improper handling of "-gen-*" and "-gnat*" flags, which were previously allowed and could desynchronize argument parsing, enabling injection of unvalidated inputs to the linker. The flags "-gen-*" and "-gnat*" are now disallowed to mitigate this risk.
A vulnerability in the Go toolchain's cmd/go on Darwin platforms allows argument injection via malicious use of cgo with specific linker flags. This can lead to arbitrary code execution due to how the Apple linker recombines separated '-l' and 'to_library' arguments into a single flag that loads an arbitrary LTO plugin dynamic library at link time. The Go toolchain has been updated to disallow these dangerous linker flags and patterns to prevent exploitation.
CVE-2026-97037 is a code injection vulnerability in the Go toolchain's cmd/go component. It arises when building a malicious package that uses cgo, allowing arbitrary code execution at link time by passing linker script files to the host linker via "#cgo LDFLAGS". The vulnerability involves improper handling of certain "-Wl," flags that could be interpreted as linker scripts, leading to potential code execution. The issue is fixed in Go versions 1.26.11 and 1.27.4.
CVE-2026-97038 is a code injection vulnerability in the Go toolchain's cmd/go component. It allows building a malicious package with specially crafted ".syso" files or cgo linker inputs that can inject arbitrary linker flags or execute code during the linking phase. The vulnerability arises because linker input files were passed to the external linker without proper validation, enabling execution of disguised linker scripts or injection of unallowlisted linker flags across multiple platforms. The issue is fixed in Go versions 1.26.11 and 1.27.4.
CVE-2026-97039 is an argument injection vulnerability in the Go toolchain's cmd/go component. It involves malicious packages using "#cgo pkg-config:" directives to load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The vulnerability arises from overly permissive allowlists for certain pkg-config flags and insufficient validation of flags returned by "pkg-config --cflags". The issue is addressed by disallowing specific flags and inspecting cgoCPPFLAGS for internal linking safety.
CVE-2026-97040 is a code injection vulnerability in the Go toolchain's cmd/go component. It allows an attacker to craft a ".syso" file that bypasses cgo flag validation and injects arbitrary linker flags during the linking process. This occurs because the linker incorrectly parses certain ".syso" files as Go compiler objects, allowing untrusted cgo metadata directives to be passed to the external linker without validation. The issue also involves improper handling of long ".syso" filenames, which can lose their extension and force external linking in pure-Go builds. The vulnerability is fixed in Go versions 1.26.11 and 1.27.4.
CVE-2026-97043 is an argument injection vulnerability in the Go toolchain's cmd/go component. It allows a malicious package using cgo to bypass validation of "#cgo LDFLAGS" directives, potentially causing unexpected code execution during build or causing the go command to panic. The issue arises from inconsistent handling of quoted linker flags between cmd/cgo and cmd/compile/cmd/go. The vulnerability is fixed in Go versions 1.26.11 and 1.27.4.
CVE-2026-94447 is a high-severity vulnerability in the Go toolchain's cmd/go component involving improper validation of integrity check values. A user working within a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and uses a malicious GOMODPROXY can bypass the intended checksum verification. The issue is addressed by ensuring that golang.org/toolchain always fetches the canonical checksum from the network.
CVE-2026-94444 is a high-severity vulnerability in the Go toolchain's cmd/go module related to improper validation of integrity check values. It allows a user working inside a malicious Go project that defines a fake golang.org/fips140 module and connects to a malicious GOMODPROXY to have an arbitrary module served in place of the legitimate one. The issue is addressed by unpacking and verifying the trusted ziphash for the bundled golang.org/fips140 module to ensure its integrity.
A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidy
CVE-2026-39819 is a medium severity vulnerability in the Go toolchain's cmd/go component. The 'go bug' command creates temporary files with predictable names in the system temporary directory. This allows an attacker with access to that directory to create symbolic links with those names, potentially causing the command to overwrite unintended files. No official patch or remediation is currently available, and no known exploits have been reported.
CVE-2026-39817 is a medium-severity path traversal vulnerability in the Go toolchain's cmd/go component, specifically affecting the 'go tool pack' subcommand. This flaw allows a malicious archive to write files to arbitrary filesystem locations due to improper sanitization of output filenames when extracting archives. It affects Go versions up to 1.26.0-0. There is currently no official patch or remediation guidance available, and no known exploits have been reported in the wild.
CVE-2026-42501 is a high-severity vulnerability in the Go toolchain's cmd/go module handling that allows a malicious module proxy to bypass checksum database validation due to improper verification of cryptographic signatures. This flaw enables acceptance of empty or unrelated checksum responses as valid, potentially leading to execution of altered Go toolchain versions or modules when using untrusted GOPROXY or GOSUMDB configurations. No official patch or remediation is currently available. Users are advised to upgrade their Go toolchain once a fix is released and can detect potential compromise by regenerating and verifying go.sum files. No known exploits have been reported in the wild at this time.
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a "--log-file" argument to this directive, causing pkg-config to write to an attacker-controlled location.
Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules from non-standard sources (e.g., custom domains) can cause unexpected code execution due to how external VCS commands are constructed. This issue can also be triggered by providing a malicious version string to the toolchain. On systems with Git installed, downloading and building modules with malicious version strings can allow an attacker to write to arbitrary files on the filesystem. This can only be triggered by explicitly providing the malicious version strings to the toolchain and does not affect usage of @latest or bare module paths.