CVE-2026-40903 Details
Description
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.
An ArtiPACKED vulnerability has been identified in goshs versions prior to 2.0.0-beta.6. This vulnerability allows the GITHUB_TOKEN to be leaked through workflow artifacts, even though the token is not present in the repository's source code. The issue arises because the actions/checkout step, which defaults to persisting credentials, saves the token in the .git/config file. If an artifact is later uploaded that includes the .git directory, the token can be extracted and misused.
To address the ArtiPACKED vulnerability, update the actions/checkout step in the affected workflows to version 4 and set persist-credentials to false. This change prevents the GITHUB_TOKEN from being saved in the .git directory, eliminating the risk of leakage through workflow artifacts.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/patrickhener/goshs/security/advisories/GHSA-hpxj-9fgp-fhhf | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| goshs goshs | < 2.0.0 2.0.0 beta1 2.0.0 beta2 2.0.0 beta3 2.0.0 beta4 2.0.0 beta5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 1, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | New CVE Received | [email protected] |