Answer in brief
CVE-2026-97043 records a Unknown severity vulnerability in Unexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compile. The current sources do not mark it as known exploited. The current feed maps Go toolchain/cmd/compile (generic), Go toolchain/cmd/go (generic), toolchain (go). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Go toolchain/cmd/compile (generic), Go toolchain/cmd/go (generic), toolchain (go). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Go toolchain/cmd/compilegeneric | >=0 <1.26.11 || >=1.27.0-0 <1.27.4 | 1.26.11, 1.27.4 |
| Go toolchain/cmd/gogeneric | >=0 <1.26.11 || >=1.27.0-0 <1.27.4 | 1.26.11, 1.27.4 |
| toolchaingo | >=0 <1.26.11 >=1.27.0-0 <1.27.4 | 1.26.11, 1.27.4 |
Published upstream
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 11, 2026
Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in "//go:cgo_ldflag" directives. When "cmd/cgo" generates "_cgo_gotypes.go", it quotes each "#cgo LDFLAGS" argument with strconv.Quote in a "//go:cgo_ldflag" directive, but "cmd/compile" and "cmd/go" parsed those directives by splitting on raw quote characters without handling backslash escapes or unquoting the string. This mismatch allowed disallowed linker flags or unvalidated linker search paths to be smuggled past the go command's flag checks and passed to the external linker. In addition, deduplicating LDFLAGS in the go command could panic with an out-of-bounds slice index when a prefix of the flag list matched near the end of the slice. "cmd/compile" and "cmd/go" now properly handle backslash-escaped quotes and unquote "//go:cgo_*" pragma strings with strconv.Unquote, and the slice bounds check in processCgoOutputs has been fixed.
Quoted source text, attributed separately from HOL analysis.