VYPR
← All advisories
Critical severity9.1NVD Advisory· Published Apr 21, 2026· Updated May 1, 2026

CVE-2026-40903

CVE-2026-40903

Description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

7
  • Goshs/Goshs7 versions
    cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:*+ 6 more
    • cpe:2.3:a:goshs:goshs:2.0.0:beta1:*:*:*:go:*:*
    • cpe:2.3:a:goshs:goshs:2.0.0:beta2:*:*:*:go:*:*
    • cpe:2.3:a:goshs:goshs:2.0.0:beta3:*:*:*:go:*:*
    • cpe:2.3:a:goshs:goshs:2.0.0:beta4:*:*:*:go:*:*
    • cpe:2.3:a:goshs:goshs:2.0.0:beta5:*:*:*:go:*:*
    • cpe:2.3:a:goshs:goshs:*:*:*:*:*:go:*:*range: <2.0.0
    • (no CPE)range: <2.0.0-beta.6

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.