GO-2026-6857: Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go

Q: Which builds are exposed to this issue?

The issue applies when cmd/go uses GCC to build a malicious package that uses cgo and its #cgo LDFLAGS enable -fopenmp, -fopenacc, or -fsanitize=. The relevant GCC spec-file searches can include -L and sysroot directories, including certain subdirectories and multilib sibling directories.

Q: When can the current or package working directory be used to trigger the issue?

GCC searches the working directory for spec files with -fopenmp or -fopenacc. It also does so when -fsanitize= is combined with -static or -static-lib*; the updated go command checks the working and package directories when those cases apply.

Q: What inputs should be checked if patching is not immediately possible?

Inspect directories supplied through -L, -isysroot, and -Wl,-syslibroot for files named specs or matching *.spec, including relevant subdirectories and multilib sibling directories such as ../lib64. Avoid building untrusted cgo packages with the affected linker flags until the updated go command can reject these locations.

Q: What protections does the updated go command add?

It rejects relevant -L, -isysroot, and -Wl,-syslibroot directories containing GCC spec files, and checks working and package directories when applicable. It also disallows @ and - prefixes in -fsanitize= compiler-flag values.

Published Nov 11, 2026

Updated

When using GCC, building a malicious package that uses cgo could cause arbitrary command execution at link time via untrusted GCC spec files ("specs" or ".spec").

When linking with "-fopenmp", "-fopenacc", or "-fsanitize=" in "#cgo LDFLAGS", GCC's built-in link spec evaluates "%:include(libgomp.spec)" or "%:include(libsanitizer.spec)" and searches for spec files in "-L" and sysroot directories (including subdirectories and multilib sibling directories such as "../lib64"), as well as the working directory when "-fopenmp" or "-fopenacc" is used or when "-fsanitize=" is combined with "-static" or "-static-lib".

The go command now rejects "-L", "-isysroot", and "-Wl,-syslibroot" directories (and the working and package directories when applicable) that contain GCC spec files, and disallows "@" and "-" prefixes in "-fsanitize=" compiler flag values.

Affected Software

2 affected componentsFixes available

go/toolchain<1.26.11

1.26.11

go/toolchain>=1.27.0-0<1.27.4

1.27.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade go/toolchain to a version that resolves this vulnerability.
Fixed in 1.26.11
Upgrade
Upgrade go/toolchain to a version that resolves this vulnerability.
Fixed in 1.27.4

Event History

Nov 11, 2026

Advisory Published

via OSV·02:51 AM

Data Sourced

via OSV·02:51 AM

DescriptionAffected Software

Frequently Asked Questions

Which builds are exposed to this issue?

The issue applies when cmd/go uses GCC to build a malicious package that uses cgo and its #cgo LDFLAGS enable -fopenmp, -fopenacc, or -fsanitize=. The relevant GCC spec-file searches can include -L and sysroot directories, including certain subdirectories and multilib sibling directories.

When can the current or package working directory be used to trigger the issue?

GCC searches the working directory for spec files with -fopenmp or -fopenacc. It also does so when -fsanitize= is combined with -static or -static-lib*; the updated go command checks the working and package directories when those cases apply.

What inputs should be checked if patching is not immediately possible?

Inspect directories supplied through -L, -isysroot, and -Wl,-syslibroot for files named specs or matching *.spec, including relevant subdirectories and multilib sibling directories such as ../lib64. Avoid building untrusted cgo packages with the affected linker flags until the updated go command can reject these locations.

What protections does the updated go command add?

It rejects relevant -L, -isysroot, and -Wl,-syslibroot directories containing GCC spec files, and checks working and package directories when applicable. It also disallows @ and - prefixes in -fsanitize= compiler-flag values.

GO-2026-6857: Arbitrary command execution via GCC spec files in cgo linker search directories in cmd/go

Affected Software

Remediation

Event History

Frequently Asked Questions

Which builds are exposed to this issue?

When can the current or package working directory be used to trigger the issue?

What inputs should be checked if patching is not immediately possible?

What protections does the updated go command add?

Company

Resources

Contact

Frequently Asked Questions

Which builds are exposed to this issue?

When can the current or package working directory be used to trigger the issue?

What inputs should be checked if patching is not immediately possible?

What protections does the updated go command add?