A vulnerability in the Go toolchain allows a crafted ".syso" file to bypass cgo flag validation and inject arbitrary linker flags during linking. This occurs because the linker incorrectly parses certain ".syso" files as Go compiler objects, enabling untrusted cgo metadata directives to be passed to the external linker without validation. Additionally, long ".syso" filenames losing their extension and unrecognized formats forced external linking in pure-Go builds. The linker has been updated to reject unrecognized ".syso" files and preserve the ".syso" suffix when truncating archive member names.