ZeroDay Findings
Sign inSign up

Findings

CVE-2026-40903

goshs is a SimpleHTTPServer written in Go.

Published Apr 21, 2026 · updated Jun 17, 2026 · goshs goshs

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 21, 2026 · NIST NVD

    Detected

    goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.

  2. Jun 17, 2026 · NIST NVD

    Updated

    goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.

Affected

  • cpe goshs/goshsversion unspecified
  • cpe goshs/goshs2.0.0

Sources

  • CVE.orgVulnerability recordCVE-2026-40903

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-40903

    goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed

    nvd.nist.gov

References