Bug 2571452 (CVE-2026-97039)

Summary:	CVE-2026-97039 cmd/go: golang: cmd/go: arbitrary code execution via crafted pkg-config directives
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, cahl, crizzo, dfreiber, dpaolell, drow, dymurray, jburrell, jdelft, jupierce, kaycoth, lgarciaa, ljawale, mbiarnes, msilmser, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sdawley, sghai, sidsharm, suppawar, vkumar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in cmd/go. This vulnerability allows an attacker to achieve arbitrary code execution when a user or automated system compiles an untrusted Go package. Due to insufficient validation of package configuration directives (`#cgo pkg-config:`), an attacker can supply crafted directives that load untrusted configuration files or inject unauthorized compiler and linker flags during the build process.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-11 03:21:59 UTC

Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "--define-variable=" values beginning with "=" or "$" (which can rewrite paths in system ".pc" files into sysroot-prefixed "-L=" or "-L$SYSROOT" linker search paths), and allowed package arguments ending in ".pc" or containing path separators or "..", which caused pkg-config to load local ".pc" files directly from the package directory. In addition, flags returned by "pkg-config --cflags" in cgoCPPFLAGS were not checked when determining whether internal linking is safe. The go command now disallows "--with-path=", "--personality=", leading "=" or "$" characters in "--define-variable=" values, and local ".pc" paths in "#cgo pkg-config:" directives, and inspects cgoCPPFLAGS when checking internal linking compatibility.