{"id":"CVE-2024-23840","aliases":["EUVD-2024-0363","GHSA-h3q2-8whx-c29h","GO-2024-2482"],"status":"published","title":"`goreleaser release --debug` shows secrets","description":"GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0032,"percentile":0.2526,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2024-01-30T16:39:09Z","modified":"2026-10-28T02:30:30Z","fixes":[{"ecosystem":"Go","package":"github.com/goreleaser/goreleaser","fixed_in":["1.24.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/goreleaser/goreleaser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.23.0"},{"last_affected":"1.23.0"},{"fixed":"1.24.0"}]}],"versions":["1.23.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/goreleaser/goreleaser","ranges":[{"type":"SEMVER","events":[{"introduced":"1.23.0"},{"fixed":"1.24.0"}]}],"versions":["1.23.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/goreleaser/goreleaser","ranges":[{"type":"SEMVER","events":[{"introduced":"1.23.0"},{"fixed":"1.24.0"}]}]}],"products":[{"vendor":"goreleaser","product":"goreleaser"}],"references":[{"url":"https://github.com/goreleaser/goreleaser/security/advisories/GHSA-h3q2-8whx-c29h","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/goreleaser/goreleaser/commit/d5b6a533ca1dc3366983d5d31ee2d2b6232b83c0","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23840","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h3q2-8whx-c29h"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23840.json","tags":["advisory"]},{"url":"https://github.com/goreleaser/goreleaser","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-23840","title":"`goreleaser release --debug` shows secrets","description":"GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.","status":"published","published":"2024-01-30T16:39:09.284Z","modified":"2025-05-29T15:04:48.029Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:34:05.444281Z"}],"euvd":[{"id":"EUVD-2024-0363","description":"GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.","status":"published","published":"2024-01-30T16:39:09Z","modified":"2025-05-29T15:04:48Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:35.823426Z"}],"ghsa":[{"id":"GHSA-h3q2-8whx-c29h","title":"`goreleaser release --debug` shows secrets","description":"### Summary\nHello 👋 \n\n`goreleaser release --debug` log shows secret values used in the in the custom publisher.\n\n\nHow to reproduce the issue:\n\n- Define a custom publisher as the one below. Make sure to provide a custom script to the `cmd` field and to provide a secret to `env` \n\n```\n#.goreleaser.yml \npublishers:\n  - name: my-publisher\n  # IDs of the artifacts we want to sign\n    ids:\n      - linux_archives\n      - linux_package\n    cmd: \"./build/package/linux_notarize.sh\"\n    env:\n      - VERSION={{ .Version }}\n      - SECRET_1={{.Env.SECRET_1}}\n      - SECRET_2={{.Env.SECRET_2}}\n```\n\n- run `goreleaser release --debug`\n\nYou should see your secret value in the gorelease log. The log shows also the `GITHUB_TOKEN`\n\nExample:\n\n```\nrunning                                        cmd= ....\nSECRET_1=secret_value\n```\n","status":"published","published":"2024-01-30T20:57:52Z","modified":"2024-01-30T20:57:55Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:37:33.019154Z"}],"nvd":[{"id":"CVE-2024-23840","description":"GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.","status":"published","published":"2024-01-30T17:15:11.81Z","modified":"2026-06-17T07:13:43.107Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:09:34.891666Z"}],"osv":[{"id":"CVE-2024-23840","title":"`goreleaser release --debug` shows secrets","description":"GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.","status":"published","published":"2024-01-30T16:39:09.284Z","modified":"2026-10-28T02:30:30.522301481Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"GHSA-h3q2-8whx-c29h","title":"`goreleaser release --debug` shows secrets","description":"### Summary\nHello 👋 \n\n`goreleaser release --debug` log shows secret values used in the in the custom publisher.\n\n\nHow to reproduce the issue:\n\n- Define a custom publisher as the one below. Make sure to provide a custom script to the `cmd` field and to provide a secret to `env` \n\n```\n#.goreleaser.yml \npublishers:\n  - name: my-publisher\n  # IDs of the artifacts we want to sign\n    ids:\n      - linux_archives\n      - linux_package\n    cmd: \"./build/package/linux_notarize.sh\"\n    env:\n      - VERSION={{ .Version }}\n      - SECRET_1={{.Env.SECRET_1}}\n      - SECRET_2={{.Env.SECRET_2}}\n```\n\n- run `goreleaser release --debug`\n\nYou should see your secret value in the gorelease log. The log shows also the `GITHUB_TOKEN`\n\nExample:\n\n```\nrunning                                        cmd= ....\nSECRET_1=secret_value\n```\n","status":"published","published":"2024-01-30T20:57:52Z","modified":"2026-09-10T03:50:09.335473528Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:48.546324Z"},{"id":"GO-2024-2482","title":"Information leak in github.com/goreleaser/goreleaser","description":"Secret values can be printed to the --debug log when using a a custom publisher.","status":"published","published":"2024-02-13T18:22:44Z","modified":"2026-02-04T04:27:50.038423Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}