GO-2026-6855: Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

Q: Who is exposed to this issue?

Systems building untrusted or malicious cgo-enabled Go packages on Darwin are exposed. The code execution occurs during the build link step through the Apple linker.

Q: What does an attacker need to exploit it?

An attacker needs to cause a target to build a package containing a crafted #cgo LDFLAGS directive. The directive uses separated "-l" and "to_library <path>" arguments so the Apple linker treats them as the -lto_library option and loads an LTO plugin library from the supplied path.

Published Nov 11, 2026

Updated

On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l tolibrary <path>" in a "#cgo LDFLAGS" directive.

The Apple linker recombines the separated arguments "-l" and "tolibrary" into "-ltolibrary", which loads an arbitrary LTO plugin dynamic library at link time.

The go command now disallows "-l" followed by "tolibrary" in "#cgo LDFLAGS", rejects "-lazylibrary", "-lazyframework", "-loadhidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.

Affected Software

2 affected componentsFixes available

go/toolchain<1.26.11

1.26.11

go/toolchain>=1.27.0-0<1.27.4

1.27.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/toolchain to a version that resolves this vulnerability.
Fixed in 1.26.11
Upgrade
Upgrade go/toolchain to a version that resolves this vulnerability.
Fixed in 1.27.4

Event History

Nov 11, 2026

Advisory Published

via OSV·02:51 AM

Data Sourced

via OSV·02:51 AM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Systems building untrusted or malicious cgo-enabled Go packages on Darwin are exposed. The code execution occurs during the build link step through the Apple linker.

What does an attacker need to exploit it?

An attacker needs to cause a target to build a package containing a crafted #cgo LDFLAGS directive. The directive uses separated "-l" and "to_library <path>" arguments so the Apple linker treats them as the -lto_library option and loads an LTO plugin library from the supplied path.

How can I tell whether a package may trigger the issue?

Inspect cgo #cgo LDFLAGS directives for "-l" followed by "to_library" and a library path. Also review for the linker options -lazy_library, -lazy_framework, -load_hidden, -library, and -library-path, which the updated go command rejects.

What mitigation is available in the updated go command?

The updated go command disallows "-l" followed by "to_library", rejects several related linker options, and checks recombined -l arguments against disallowed linker flags and patterns.

GO-2026-6855: Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether a package may trigger the issue?

What mitigation is available in the updated go command?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether a package may trigger the issue?

What mitigation is available in the updated go command?