Most recent entries from all

bdu:2024-01013

2026-10-10T16:10:49.530155+00:00

bdu:2024-01013

EUVD-2026-241781

2026-10-10T16:10:49.530198+00:00

EUVD-2026-241781

fkie_cve-2024-23840

2026-10-10T16:10:49.530218+00:00

GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.

GHSA-h3q2-8whx-c29h — `goreleaser release --debug` shows secrets

2026-10-10T16:10:49.530257+00:00

Affected: Go: github.com/goreleaser/goreleaser

### Summary Hello 👋

`goreleaser release --debug` log shows secret values used in the in the custom publisher.

How to reproduce the issue:

- Define a custom publisher as the one below. Make sure to provide a custom script to the `cmd` field and to provide a secret to `env`

``` #.goreleaser.yml publishers: - name: my-publisher # IDs of the artifacts we want to sign ids: - linux_archives - linux_package cmd: "./build/package/linux_notarize.sh" env: - VERSION={{ .Version }} - SECRET_1={{.Env.SECRET_1}} - SECRET_2={{.Env.SECRET_2}} ```

- run `goreleaser release --debug`

You should see your secret value in the gorelease log. The log shows also the `GITHUB_TOKEN`

Example:

``` running cmd= .... SECRET_1=secret_value ```

gsd-2024-23840

2026-10-10T16:10:49.530315+00:00

gsd-2024-23840