AZL-113486: CVE-2026-97033 affecting package golang 1.27.4-1
Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; "-target" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and "-x" permitted specifying arbitrary compiler input languages beyond those supported by cgo. "--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and "-Wl,-syslibroot" are verified not to point to regular files, and "-x" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Build environments that compile untrusted or malicious Go packages using cgo are exposed. The code execution occurs during the build process, so systems that only run already-built binaries are not described as affected.
What does an attacker need to exploit it?
An attacker needs to cause a target to build a malicious package containing crafted #cgo directives. The directives can abuse compiler or linker flags to make build tooling use attacker-controlled files, helper tools, or linker scripts.
Are default cgo builds affected?
The issue requires malicious #cgo flags in the package being built. The provided information does not indicate that ordinary cgo builds without attacker-controlled directives trigger the behavior.
What changes address the problem?
The affected flags are constrained by disallowing --sysroot and -target, validating that -isysroot and -Wl,-syslibroot do not reference regular files, and limiting -x to cgo-supported C, C++, Objective-C, and assembler languages.