1 line
1.6 KiB
JSON
1 line
1.6 KiB
JSON
{"schema_version":"1.9.2","id":"GO-2026-6855","published":"2026-11-11T02:51:11Z","modified":"2026-11-11T03:15:15.677114364Z","aliases":["CVE-2026-97036"],"summary":"Arbitrary code execution during build on darwin via \"-l to_library\" in cgo in cmd/go","details":"On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing \"-l to_library <path>\" in a \"#cgo LDFLAGS\" directive.\n\nThe Apple linker recombines the separated arguments \"-l\" and \"to_library\" into \"-lto_library\", which loads an arbitrary LTO plugin dynamic library at link time.\n\nThe go command now disallows \"-l\" followed by \"to_library\" in \"#cgo LDFLAGS\", rejects \"-lazy_library\", \"-lazy_framework\", \"-load_hidden\", \"-library\", and \"-library-path\", and checks recombined \"-l\" arguments against disallowed linker flags and patterns.","affected":[{"package":{"name":"toolchain","ecosystem":"Go","purl":"pkg:golang/toolchain"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.11"},{"introduced":"1.27.0-0"},{"fixed":"1.27.4"}]}],"ecosystem_specific":{"imports":[{"goos":["darwin"],"path":"cmd/go"}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6855.json"}}],"references":[{"type":"FIX","url":"https://go.dev/cl/862149"},{"type":"REPORT","url":"https://go.dev/issue/82574"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iY8TY0wWgbM"}],"database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6855"},"credits":[{"name":"Ali Sherif (https://www.linkedin.com/in/ali-sherif-13812b276/)"}]} |