CVE-2026-97041: 
Golang vulnerability analysis and mitigation

CVE-2026-97041 is an argument injection vulnerability in the Go toolchain's compiler (cmd/compile) and linker (cmd/link) that allows a malicious Go package to inject arbitrary flags into external linker invocations on ELF platforms. The flaw stems from the compiler and linker failing to reject commas or leading @ characters in //go:cgo_* compiler directives, enabling flag splitting attacks against the host linker. Affected versions include Go toolchain releases before 1.26.11 and 1.27.0-0 through 1.27.4 (before 1.27.4). The vulnerability was published on November 11, 2026, with patches released the same day. The CVSS category is estimated as Medium, with an EPSS score of 0.0 (GitHub Advisory, Feedly).

The root cause is improper neutralization of argument delimiters in compiler directive processing (CWE-88: Argument Injection). The Go compiler and linker accepted commas and leading @ characters in //go:cgo_import_dynamic, //go:cgo_export_dynamic, //go:cgo_export_static, //go:cgo_import_static, and //go:cgo_dynamic_linker directives without validation. Because the linker historically passed the dynamic linker path as -Wl,--dynamic-linker,<path> (comma-separated), a crafted path containing a comma could split this into multiple arbitrary linker flags or response file arguments. Additionally, the two-argument form of //go:cgo_import_dynamic — permitted even in non-cgo Go source files — could overwrite the external symbol name of a symbol already marked for cgo export, providing a second injection vector. The fix changes the linker to use -Wl,--dynamic-linker=<path> (equals-separated) and enforces rejection of commas in all //go:cgo_* directives (GitHub Advisory, Go Issue).

An attacker who can distribute a malicious Go package can inject arbitrary host linker flags during the build process on ELF platforms (Linux and other ELF-based systems), potentially achieving code execution on the machine performing the build. This is a supply-chain attack vector: any developer or CI/CD pipeline that compiles a malicious dependency using an affected Go toolchain version is at risk. The integrity of compiled binaries could be compromised, and the confidentiality and availability of the build environment may be affected through arbitrary linker flag manipulation (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an attacker to distribute a malicious Go package that a victim compiles using an affected toolchain version on an ELF platform, making it a supply-chain attack scenario rather than a direct remote exploit.

1. Craft a malicious Go package: Create a Go source file containing crafted //go:cgo_* directives with commas or leading @ characters embedded in symbol names or dynamic linker paths (e.g., //go:cgo_dynamic_linker "/lib/ld-linux.so.2,--some-malicious-flag").
2. Distribute the package: Publish the malicious package to a public or private Go module registry, or introduce it as a dependency via a supply-chain compromise (e.g., typosquatting, dependency confusion).
3. Victim compiles the package: A developer or CI/CD system running an affected Go toolchain (< 1.26.11 or 1.27.0–1.27.4) on an ELF platform imports and builds the malicious package.
4. Flag injection occurs: During compilation, the Go compiler processes the malicious //go:cgo_* directives and passes the unsanitized values to the external linker (e.g., gcc/ld), splitting the comma-delimited argument into arbitrary linker flags.
5. Achieve code execution or binary manipulation: The injected linker flags (e.g., specifying a malicious dynamic linker or response file) cause the linker to produce a compromised binary or execute attacker-controlled code during the link step on the build machine (GitHub Advisory, Go Issue).

• Build Logs: Unexpected or unrecognized flags appearing in linker invocation logs (e.g., extra -Wl, arguments not originating from the project's own build configuration).
• File System: Presence of Go source files containing //go:cgo_* directives with commas or leading @ in symbol names or linker paths in third-party dependencies.
• Process: Unusual child processes spawned by the Go linker or compiler during build (e.g., unexpected network connections, file writes outside the build directory).
• Network: Outbound connections from the build environment to unexpected hosts during the link phase, which may indicate a malicious dynamic linker or post-link payload being executed.

Upgrade the Go toolchain to version 1.26.11 or 1.27.4 (or later), which fix the vulnerability by rejecting commas in //go:cgo_* directives, switching to =-delimited -Wl,--dynamic-linker=<path> syntax, and preventing cgo_import_dynamic from overwriting cgo-exported symbols. No configuration-based workaround is available; upgrading is the only remediation. Organizations should also audit third-party Go dependencies for suspicious //go:cgo_* directives as a supply-chain hygiene measure (GitHub Advisory, Go Announce).

The Go security team disclosed the vulnerability via the golang-announce mailing list on November 11, 2026, alongside the release of patched toolchain versions. The issue was also discussed on the oss-security mailing list. No significant independent researcher commentary or broad media coverage has been identified beyond standard vulnerability tracking sources.