Google cmd cgo compile link up to 1.26.10/1.27.3 cgo/link argument injection

Summaryinfo

A vulnerability described as critical has been identified in Google cmd cgo compile link up to 1.26.10/1.27.3. Impacted is an unknown function of the component cgo/link. The manipulation results in argument injection. This vulnerability is cataloged as CVE-2026-97042. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, was found in Google cmd cgo compile link up to 1.26.10/1.27.3. Affected is an unknown code block of the component cgo/link. The manipulation with an unknown input leads to a argument injection vulnerability. CWE is classifying the issue as CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgo_import_dynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgo_import_dynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".

This vulnerability is traded as CVE-2026-97042 since 09/24/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 11/11/2026). This vulnerability is assigned to T1059 by the MITRE ATT&CK project.

Upgrading to version 1.26.11 or 1.27.4 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Google

Name

• cmd cgo compile link

Version

• 1.26.0
• 1.26.1
• 1.26.2
• 1.26.3
• 1.26.4
• 1.26.5
• 1.26.6
• 1.26.7
• 1.26.8
• 1.26.9
• 1.26.10
• 1.27.0
• 1.27.1
• 1.27.2
• 1.27.3

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion