Skip to content

Vendor

goreleaser vulnerabilities

3 published CVES affecting goreleaser, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
1
Medium
2
Low
0
Unscored
0
CISA KEV
0
Atom feed of goreleaser alerts

Products

Latest goreleaser CVEs

Newest publication first

  1. GHSA-f6mm-5fc7-3g3c goreleaser shows environment by default

    Published
    MediumCVSS 6.2

    Summary Since #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the go build output is non-empty, goreleaser leaks the environment. PoC Create a Go project with dependencies, do not pull them yet (or run goreleaser later in...

  2. CVE-2024-23840 `goreleaser release --debug` shows secrets

    Published
    MediumCVSS 5.5 EPSS 0.32%

    GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. goreleaser release --debug log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.

  3. CVE-2023-32698 nfpm vulnerable to Incorrect Default Permissions

    Published
    HighCVSS 7.1 EPSS 0.38%

    nFPM is an alternative to fpm. The file permissions on the checked-in files were not maintained. Hence, when nfpm packaged the files (without extra config for enforcing it’s own permissions) files could go out with bad permissions (chmod 666 or 777). Anyone using nfpm for creatin...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.