{"id":"CVE-2026-40903","aliases":["EUVD-2026-24282","GHSA-hpxj-9fgp-fhhf"],"status":"published","title":"Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence","description":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00245,"percentile":0.15802,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-829"],"published":"2026-04-21T19:43:36Z","modified":"2026-10-28T02:31:00Z","products":[{"vendor":"goshs","product":"goshs"},{"vendor":"patrickhener","product":"goshs"}],"references":[{"url":"https://github.com/patrickhener/goshs/security/advisories/GHSA-hpxj-9fgp-fhhf","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40903.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40903","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-40903","title":"Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence","description":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.","status":"published","published":"2026-04-21T19:43:36.037Z","modified":"2026-04-22T13:45:41.782Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T13:43:11.445168Z"}],"euvd":[{"id":"EUVD-2026-24282","description":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.","status":"published","published":"2026-04-21T19:43:36Z","modified":"2026-04-22T13:45:41Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T19:24:20.71791Z"}],"nvd":[{"id":"CVE-2026-40903","description":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.","status":"published","published":"2026-04-21T20:17:02.947Z","modified":"2026-10-26T21:10:00.17Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"secondary"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T14:12:15.493943Z"}],"osv":[{"id":"CVE-2026-40903","title":"Goshs - ArtiPACKED Vulnerability – GitHub Actions Credential Persistence","description":"goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.","status":"published","published":"2026-04-21T19:43:36.037Z","modified":"2026-10-28T02:31:00.721806701Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-829"],"updated_at":"2026-11-02T15:45:03.424067Z"}]}}