CVE-2026-40903
Critical
Description
goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.
SeverityCritical
CVSS9.1
Exploit probability—
ProductGoshs
PublishedApr 21, 2026
First seenApr 21, 2026
Weakness typeCWE-829CWE-829
How to fix
Update
- goshs goshs2.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| goshs goshs | v < 2.0.0, 2.0.0 | 2.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.