GO-2026-6852: Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go

Q: Who is exposed to this issue?

Build environments that compile untrusted or malicious Go packages using cgo are exposed. Exploitation depends on the package containing #cgo pkg-config: directives that cause pkg-config to load attacker-controlled .pc files or process unsafe arguments or returned flags.

Q: Does exploitation require a nondefault build configuration?

The vulnerable behavior is in cmd/go handling of #cgo pkg-config: directives. The provided information does not identify any additional nondefault configuration requirement beyond building a package that uses those directives.

Q: How can I identify a potentially affected package before updating?

Inspect dependencies being built with cgo for #cgo pkg-config: directives. Treat directives using --with-path=, --personality=, --define-variable= values beginning with = or $, package arguments ending in .pc, or arguments containing path separators or .. as indicators of exposure.

Q: What can be done if the toolchain cannot be updated immediately?

Avoid building untrusted packages that use cgo pkg-config directives, and review or remove unsafe arguments from trusted package directives. In particular, do not permit local .pc paths, path traversal or separator-containing package arguments, --with-path=, --personality=, or --define-variable= values beginning with = or $.

Published Nov 11, 2026

Updated

Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags.

The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe.

The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.

Affected Software

2 affected componentsFixes available

go/toolchain<1.26.11

1.26.11

go/toolchain>=1.27.0-0<1.27.4

1.27.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/toolchain to a version that resolves this vulnerability.
Fixed in 1.26.11
Upgrade
Upgrade go/toolchain to a version that resolves this vulnerability.
Fixed in 1.27.4

Event History

Nov 11, 2026

Advisory Published

via OSV·02:51 AM

Data Sourced

via OSV·02:51 AM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Build environments that compile untrusted or malicious Go packages using cgo are exposed. Exploitation depends on the package containing #cgo pkg-config: directives that cause pkg-config to load attacker-controlled .pc files or process unsafe arguments or returned flags.

Does exploitation require a nondefault build configuration?

The vulnerable behavior is in cmd/go handling of #cgo pkg-config: directives. The provided information does not identify any additional nondefault configuration requirement beyond building a package that uses those directives.

How can I identify a potentially affected package before updating?

Inspect dependencies being built with cgo for #cgo pkg-config: directives. Treat directives using --with-path=, --personality=, --define-variable= values beginning with = or $, package arguments ending in .pc, or arguments containing path separators or .. as indicators of exposure.

What can be done if the toolchain cannot be updated immediately?

Avoid building untrusted packages that use cgo pkg-config directives, and review or remove unsafe arguments from trusted package directives. In particular, do not permit local .pc paths, path traversal or separator-containing package arguments, --with-path=, --personality=, or --define-variable= values beginning with = or $.

GO-2026-6852: Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require a nondefault build configuration?

How can I identify a potentially affected package before updating?

What can be done if the toolchain cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Does exploitation require a nondefault build configuration?

How can I identify a potentially affected package before updating?

What can be done if the toolchain cannot be updated immediately?