{"id":"GO-2026-6857","summary":"Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go","details":"When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files (\"specs\" or \"*.spec\").\n\nWhen linking with \"-fopenmp\", \"-fopenacc\", or \"-fsanitize=\" in \"#cgo LDFLAGS\", GCC's built-in link spec evaluates \"%:include(libgomp.spec)\" or \"%:include(libsanitizer.spec)\" and searches for spec files in \"-L\" and sysroot directories (including subdirectories and multilib sibling directories such as \"../lib64\"), as well as the working directory when \"-fopenmp\" or \"-fopenacc\" is used or when \"-fsanitize=\" is combined with \"-static\" or \"-static-lib*\".\n\nThe go command now rejects \"-L\", \"-isysroot\", and \"-Wl,-syslibroot\" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows \"@\" and \"-\" prefixes in \"-fsanitize=\" compiler flag values.","aliases":["CVE-2026-97034"],"modified":"2026-11-11T03:15:14.793749820Z","published":"2026-11-11T02:51:11Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6857"},"references":[{"type":"FIX","url":"https://go.dev/cl/862147"},{"type":"REPORT","url":"https://go.dev/issue/82576"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6857.json"}}],"schema_version":"1.9.2"}