Google Go up to 1.26.10/1.27.3 Cgo Directive Parser argument injection

Summaryinfo

A vulnerability was found in Google Go up to 1.26.10/1.27.3. It has been classified as critical. This impacts an unknown function of the component Cgo Directive Parser. The manipulation leads to argument injection. This vulnerability is uniquely identified as CVE-2026-97036. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Google Go up to 1.26.10/1.27.3 and classified as critical. This issue affects an unknown code block of the component Cgo Directive Parser. The manipulation with an unknown input leads to a argument injection vulnerability. Using CWE to declare the problem leads to CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library <path>" in a "#cgo LDFLAGS" directive. The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time. The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.

The identification of this vulnerability is CVE-2026-97036 since 09/24/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/11/2026). The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 1.26.11 or 1.27.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• Google

Name

• Go

Version

• 1.26.0
• 1.26.1
• 1.26.2
• 1.26.3
• 1.26.4
• 1.26.5
• 1.26.6
• 1.26.7
• 1.26.8
• 1.26.9
• 1.26.10
• 1.27.0
• 1.27.1
• 1.27.2
• 1.27.3

License

• open-source

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion