Is CVE-2026-97039 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-97039 being exploited in the wild.

How severe is CVE-2026-97039?

Informational severity, published 11 November 2026.

Which products and versions are affected?

go (Go) before the fix; toolchain (Go) SEMVER:introduced=0,fixed=1.26.11,introduced=1.27.0-0,fixed=1.27.4.

Is there a fix for CVE-2026-97039?

Yes. toolchain (Go): upgrade to 1.27.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-97039 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-97039?

Check whether you run go (Go) or toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-97039: Go command unsafe pkg-config flag handling in cgo

CVE-2026-97039 · Severity: info · Published 2026-11-11

The Go compiler's cgo build tool could be tricked into loading untrusted configuration files and injecting malicious compiler flags when processing malicious packages. An attacker could craft a malicious Go package that, when compiled, loads local or system pkg-config files from unexpected locations or injects unvalidated compiler and linker flags, potentially leading to arbitrary code injection during the build process.

Technologies: go (Go), toolchain (Go). Vendors: Go.

Quick answers

Is CVE-2026-97039 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-97039 being exploited in the wild.
How severe is CVE-2026-97039?: Informational severity, published 11 November 2026.
Which products and versions are affected?: go (Go) before the fix; toolchain (Go) SEMVER:introduced=0,fixed=1.26.11,introduced=1.27.0-0,fixed=1.27.4.
Is there a fix for CVE-2026-97039?: Yes. toolchain (Go): upgrade to 1.27.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-97039 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-97039?: Check whether you run go (Go) or toolchain (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

toolchain (Go): upgrade to 1.27.4 or later
```
go get toolchain@v1.27.4
```

Technical details

The Go command's cgo subsystem failed to properly validate pkg-config directives and flags in "#cgo pkg-config:" pragmas. The vulnerability allows local ".pc" file loading from package directories, unsanitized "--define-variable=" values that can rewrite system paths, and dangerous flags like "--with-path=" and "--personality=". Additionally, cgoCPPFLAGS output was not inspected when determining internal linking safety. Exploitation requires building a malicious package locally or accepting one from an untrusted source.

Affected products

Go Go before the fix

Identifiers

CVE-2026-97039
GO-2026-6852

Timeline

2026-11-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.