Skip to content
OpenAdvisories

Package · Go

github.com/goreleaser/goreleaser

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 6.2
    GHSA-f6mm-5fc7-3g3c

    goreleaser shows environment by default

    ### Summary Since #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the `go build` output is non-empty, goreleaser leaks the environment. ### PoC * Create a Go project with dependencies, do not pull them…

    github.com/goreleaser/goreleaser Go
  • Medium 5.5
    CVE-2024-23840

    `goreleaser release --debug` shows secrets

    GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24…

    goreleaser goreleaser github.com/goreleaser/goreleaser Go