{"id":"GHSA-f6mm-5fc7-3g3c","aliases":["GO-2024-2860"],"url":"https://o3.security/vulnerability/GHSA-f6mm-5fc7-3g3c","summary":"goreleaser shows environment by default","details":"### Summary\nSince #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the `go build` output is non-empty, goreleaser leaks the environment.\n\n### PoC\n* Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete `$GOPATH/pkg`).\n* Make sure to have secrets set in the environment\n* Make sure to not have `go mod tidy` in a before hook\n* Run `goreleaser release --clean`\n* Go prints lots of `go: downloading ...` lines, which triggers the \"if output not empty, log it\" line, which includes the environment.\n\n### Impact\nCredentials and tokens are leaked.","published":"2024-05-15T17:17:10Z","modified":"2026-09-10T03:50:00.369183280Z","cvss":{"score":6.2,"severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/goreleaser/goreleaser","fixedVersion":"1.26.1"}],"fix":{"url":"https://github.com/goreleaser/goreleaser/pull/4787","label":"goreleaser/goreleaser#4787"},"references":[{"type":"WEB","url":"https://github.com/goreleaser/goreleaser/security/advisories/GHSA-f6mm-5fc7-3g3c"},{"type":"WEB","url":"https://github.com/goreleaser/goreleaser/pull/4787"},{"type":"WEB","url":"https://github.com/goreleaser/goreleaser/commit/22f734e41f7a5111a031a3a4eb714c1b6aa6456b"},{"type":"PACKAGE","url":"https://github.com/goreleaser/goreleaser"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:50:00.369183280Z"}}