PT-2026-34060 · Goshs · Goshs

Jaisurya-Me

·

CVE-2026-40903

·

Published

2026-04-21

·

Updated

2026-05-12

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.0.0-beta.6
Description goshs is a SimpleHTTPServer written in Go. An ArtiPACKED issue allows the leakage of the GITHUB TOKEN through workflow artifacts, even when the token is not included in the repository source code.
Recommendations Update to version 2.0.0-beta.6.

Exploit

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2026-40903
GHSA-HPXJ-9FGP-FHHF

Affected Products

Goshs