AZL-113573: CVE-2026-97042 affecting package python-tensorboard 2.16.2-6
Building a malicious package that uses "//go:cgoimportdynamic" or links against a crafted PE object on Windows could pass unsafe library arguments to the external linker. The compiler only checked the first character of the library name in "//go:cgoimportdynamic" directives and skipped validation in cgo-generated files. In addition, on Windows, "cmd/cgo" and "cmd/link" did not validate imported DLL names extracted from PE object files before emitting "-l<name>" flags for the external linker, allowing a crafted DLL name containing ".." path traversal or special characters to reference arbitrary files on disk. The compiler now validates every character of the library name in "//go:cgoimportdynamic" directives (including in cgo-generated files on Windows) and rejects ".." path traversal, and "cmd/cgo" and "cmd/link" reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
The issue affects Windows build environments that compile a malicious package using cgo directives or link against a crafted PE object. It concerns unsafe arguments passed to an external linker during the build process.
What does an attacker need to exploit it?
An attacker needs to cause a Windows build to process a malicious package containing a //go:cgo_import_dynamic directive or a crafted PE object. The malicious library or DLL name can include path traversal or special characters that are turned into external-linker arguments.
How can I tell whether a build input is suspicious?
Inspect Go source and generated cgo files for //go:cgo_import_dynamic library names, and inspect PE object imports used during Windows builds. Names containing "..", path separators, ":", or a leading "-" or "@" are indicators relevant to this issue.
What protections does the corrected behavior provide?
The compiler validates every character in //go:cgo_import_dynamic library names, including cgo-generated files on Windows, and rejects ".." path traversal. The cgo and link tools also reject PE imported DLL names containing path separators, "..", ":", or leading "-" or "@".