Vulnerability GO-2026-6855
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
5 hours ago
November 11, 2026 at 02:51 AM UTC
Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go
<1.26.11, >=1.27.0-0 <1.27.4
<1.26.11, >=1.27.0-0 <1.27.4
Summary
Arbitrary code execution during build on darwin via "-l to_library" in cgo in cmd/go
Details
On Darwin, building a malicious package that uses cgo could cause arbitrary code execution when using the Apple linker due to passing "-l to_library " in a "#cgo LDFLAGS" directive.
The Apple linker recombines the separated arguments "-l" and "to_library" into "-lto_library", which loads an arbitrary LTO plugin dynamic library at link time.
The go command now disallows "-l" followed by "to_library" in "#cgo LDFLAGS", rejects "-lazy_library", "-lazy_framework", "-load_hidden", "-library", and "-library-path", and checks recombined "-l" arguments against disallowed linker flags and patterns.
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
5 hours ago
Unexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compile
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6848
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6848
Unknown
5 hours ago
Linker flag injection via cgo_import_dynamic and PE DLL names in cmd/cgo, cmd/compile, and cmd/link
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6849
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6849
Unknown
5 hours ago
Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6850
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6850
Unknown
5 hours ago
Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6851
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6851
Unknown
5 hours ago
Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6852
<1.26.11, >=1.27.0-0 <1.27.4 GO-2026-6852
Impacted packages
Timeline
Published
5 hours ago
November 11, 2026 at 02:51 AM UTC
Last Modified
5 hours ago
November 11, 2026 at 03:15 AM UTC