Google cmd go compile up to 1.26.10/1.27.3 Cgo _cgo_gotypes.go processCgoOutputs argument injection

Summaryinfo

A vulnerability classified as problematic has been found in Google cmd go compile up to 1.26.10/1.27.3. The affected element is the function processCgoOutputs of the file _cgo_gotypes.go of the component Cgo. This manipulation causes argument injection. This vulnerability is registered as CVE-2026-97043. The attack needs to be launched locally. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Google cmd go compile up to 1.26.10/1.27.3 and classified as problematic. Affected by this vulnerability is the function processCgoOutputs of the file _cgo_gotypes.go of the component Cgo. The manipulation with an unknown input leads to a argument injection vulnerability. The CWE definition for the vulnerability is CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in "//go:cgo_ldflag" directives. When "cmd/cgo" generates "_cgo_gotypes.go", it quotes each "#cgo LDFLAGS" argument with strconv.Quote in a "//go:cgo_ldflag" directive, but "cmd/compile" and "cmd/go" parsed those directives by splitting on raw quote characters without handling backslash escapes or unquoting the string. This mismatch allowed disallowed linker flags or unvalidated linker search paths to be smuggled past the go command's flag checks and passed to the external linker. In addition, deduplicating LDFLAGS in the go command could panic with an out-of-bounds slice index when a prefix of the flag list matched near the end of the slice. "cmd/compile" and "cmd/go" now properly handle backslash-escaped quotes and unquote "//go:cgo_*" pragma strings with strconv.Unquote, and the slice bounds check in processCgoOutputs has been fixed.

This vulnerability is known as CVE-2026-97043 since 09/24/2026. The exploitation appears to be easy. Attacking locally is a requirement. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/11/2026). The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 1.26.11 or 1.27.4 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Google

Name

• cmd go compile

Version

• 1.26.0
• 1.26.1
• 1.26.2
• 1.26.3
• 1.26.4
• 1.26.5
• 1.26.6
• 1.26.7
• 1.26.8
• 1.26.9
• 1.26.10
• 1.27.0
• 1.27.1
• 1.27.2
• 1.27.3

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion