CVE-2026-40903

Published: Apr 21, 2026Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: security-advisories@github.com (Secondary)

Description

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.

Affected (6)

Products: Goshs: Goshs

Goshs

1 product

Goshs

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Goshs Goshs	Before 2.0.0
Goshs Goshs	Version 2.0.0 beta1
Goshs Goshs	Version 2.0.0 beta2
Goshs Goshs	Version 2.0.0 beta3
Goshs Goshs	Version 2.0.0 beta4
Goshs Goshs	Version 2.0.0 beta5

Related CWEs

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

References (1)

https://github.com/patrickhener/goshs/security/advisories/GHSA-hpxj-9fgp-fhhf

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.