{"id":"GHSA-f6mm-5fc7-3g3c","aliases":["GO-2024-2860"],"status":"published","title":"goreleaser shows environment by default","description":"### Summary\nSince #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the `go build` output is non-empty, goreleaser leaks the environment.\n\n### PoC\n* Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete `$GOPATH/pkg`).\n* Make sure to have secrets set in the environment\n* Make sure to not have `go mod tidy` in a before hook\n* Run `goreleaser release --clean`\n* Go prints lots of `go: downloading ...` lines, which triggers the \"if output not empty, log it\" line, which includes the environment.\n\n### Impact\nCredentials and tokens are leaked.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2024-05-15T17:17:10Z","modified":"2026-09-10T03:50:00Z","fixes":[{"ecosystem":"Go","package":"github.com/goreleaser/goreleaser","fixed_in":["1.26.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/goreleaser/goreleaser","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.0"},{"last_affected":"1.26.0"},{"fixed":"1.26.1"}]}],"versions":["1.26.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/goreleaser/goreleaser","ranges":[{"type":"SEMVER","events":[{"introduced":"1.26.0"},{"fixed":"1.26.1"}]}],"versions":["1.26.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/goreleaser/goreleaser","ranges":[{"type":"SEMVER","events":[{"introduced":"1.26.0"},{"fixed":"1.26.1"}]}]}],"references":[{"url":"https://github.com/goreleaser/goreleaser/security/advisories/GHSA-f6mm-5fc7-3g3c","tags":["web","advisory"]},{"url":"https://github.com/goreleaser/goreleaser/pull/4787","tags":["web","fix"]},{"url":"https://github.com/goreleaser/goreleaser/commit/22f734e41f7a5111a031a3a4eb714c1b6aa6456b","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-f6mm-5fc7-3g3c"},{"url":"https://github.com/goreleaser/goreleaser","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-f6mm-5fc7-3g3c","title":"goreleaser shows environment by default","description":"### Summary\nSince #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the `go build` output is non-empty, goreleaser leaks the environment.\n\n### PoC\n* Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete `$GOPATH/pkg`).\n* Make sure to have secrets set in the environment\n* Make sure to not have `go mod tidy` in a before hook\n* Run `goreleaser release --clean`\n* Go prints lots of `go: downloading ...` lines, which triggers the \"if output not empty, log it\" line, which includes the environment.\n\n### Impact\nCredentials and tokens are leaked.","status":"published","published":"2024-05-15T17:17:10Z","modified":"2024-05-15T18:06:11Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:37:49.48194Z"}],"osv":[{"id":"GHSA-f6mm-5fc7-3g3c","title":"goreleaser shows environment by default","description":"### Summary\nSince #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the `go build` output is non-empty, goreleaser leaks the environment.\n\n### PoC\n* Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete `$GOPATH/pkg`).\n* Make sure to have secrets set in the environment\n* Make sure to not have `go mod tidy` in a before hook\n* Run `goreleaser release --clean`\n* Go prints lots of `go: downloading ...` lines, which triggers the \"if output not empty, log it\" line, which includes the environment.\n\n### Impact\nCredentials and tokens are leaked.","status":"published","published":"2024-05-15T17:17:10Z","modified":"2026-09-10T03:50:00.36918328Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"GO-2024-2860","title":"goreleaser shows environment by default in github.com/goreleaser/goreleaser","description":"goreleaser shows environment by default in github.com/goreleaser/goreleaser","status":"published","published":"2024-06-04T15:19:21Z","modified":"2026-02-04T03:44:32.81545Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}