https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 16:10:48 +0000 https://cve.radiocsirt.org/vuln/bdu:2024-01013 bdu:2024-01013 https://cve.radiocsirt.org/vuln/bdu:2024-01013 https://cve.radiocsirt.org/vuln/euvd-2026-241781 EUVD-2026-241781 https://cve.radiocsirt.org/vuln/euvd-2026-241781 https://cve.radiocsirt.org/vuln/fkie_cve-2024-23840 <p>GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.</p> <p>GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-23840 https://cve.radiocsirt.org/vuln/ghsa-h3q2-8whx-c29h <p><strong>Affected:</strong> Go: github.com/goreleaser/goreleaser</p> <p>### Summary Hello 👋</p> <p>`goreleaser release --debug` log shows secret values used in the in the custom publisher.</p> <p>How to reproduce the issue:</p> <p>- Define a custom publisher as the one below. Make sure to provide a custom script to the `cmd` field and to provide a secret to `env`</p> <p>``` #.goreleaser.yml publishers: - name: my-publisher # IDs of the artifacts we want to sign ids: - linux_archives - linux_package cmd: &#34;./build/package/linux_notarize.sh&#34; env: - VERSION={{ .Version }} - SECRET_1={{.Env.SECRET_1}} - SECRET_2={{.Env.SECRET_2}} ```</p> <p>- run `goreleaser release --debug`</p> <p>You should see your secret value in the gorelease log. The log shows also the `GITHUB_TOKEN`</p> <p>Example:</p> <p>``` running cmd= .... SECRET_1=secret_value ```</p> <p><strong>Affected:</strong> Go: github.com/goreleaser/goreleaser</p> <p>### Summary Hello 👋</p> <p>`goreleaser release --debug` log shows secret values used in the in the custom publisher.</p> <p>How to reproduce the issue:</p> <p>- Define a custom publisher as the one below. Make sure to provide a custom script to the `cmd` field and to provide a secret to `env`</p> <p>``` #.goreleaser.yml publishers: - name: my-publisher # IDs of the artifacts we want to sign ids: - linux_archives - linux_package cmd: &#34;./build/package/linux_notarize.sh&#34; env: - VERSION={{ .Version }} - SECRET_1={{.Env.SECRET_1}} - SECRET_2={{.Env.SECRET_2}} ```</p> <p>- run `goreleaser release --debug`</p> <p>You should see your secret value in the gorelease log. The log shows also the `GITHUB_TOKEN`</p> <p>Example:</p> <p>``` running cmd= .... SECRET_1=secret_value ```</p> https://cve.radiocsirt.org/vuln/ghsa-h3q2-8whx-c29h https://cve.radiocsirt.org/vuln/gsd-2024-23840 gsd-2024-23840 https://cve.radiocsirt.org/vuln/gsd-2024-23840