Answer in brief
CVE-2026-97039 records a Unknown severity vulnerability in Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go. The current sources do not mark it as known exploited. The current feed maps Go toolchain/cmd/go (generic), toolchain (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Go toolchain/cmd/go (generic), toolchain (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Go toolchain/cmd/gogeneric | >=0 <1.26.11 || >=1.27.0-0 <1.27.4 | 1.26.11, 1.27.4 |
| toolchaingo | >=0 <1.26.11 >=1.27.0-0 <1.27.4 | 1.26.11, 1.27.4 |
Published upstream
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 11, 2026
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.
Quoted source text, attributed separately from HOL analysis.