VYPR
Get started
← All advisories
Critical severity9.1NVD Advisory· Published Apr 21, 2026· Updated May 1, 2026

CVE-2026-40903

CVE-2026-40903

Description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.

Affected products

6
  • Goshs/Goshs6 versions
    cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:*+ 5 more
    • cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:*
    • cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:*
    • cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:*
    • cpe:2.3:a:goshs:goshs:2.0.0:beta4:*:*:*:go:*:*
    • cpe:2.3:a:goshs:goshs:2.0.0:beta5:*:*:*:go:*:*
    • cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:*range: <2.0.0

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

1

News mentions

0

No linked articles in our index yet.