AZL-113390: CVE-2026-97039 affecting package gcc 13.2.0-7
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Build environments that compile untrusted or insufficiently reviewed Go packages using cgo are exposed. Exploitation depends on the package containing a crafted #cgo pkg-config directive and the build invoking pkg-config for that package.
What inputs can a malicious package use to influence pkg-config behavior?
The affected behavior allowed pkg-config options such as --with-path= and --personality=, and --define-variable= values beginning with = or $. It also allowed package arguments ending in .pc or containing path separators or .., enabling direct loading of local .pc files from the package directory.
How can teams identify potentially affected package sources?
Review #cgo pkg-config directives for --with-path=, --personality=, --define-variable= values starting with = or $, and package arguments containing .pc, path separators, or ... Also review whether pkg-config-supplied cflags are used during builds that rely on internal-linking safety decisions.
What changes address the issue?
Use a go command version that rejects the identified pkg-config options, unsafe --define-variable values, and local .pc paths in #cgo pkg-config directives. The corrected behavior also checks cgoCPPFLAGS returned by pkg-config when determining whether internal linking is safe.