Skip to content

CVE-2026-40903 - goshs ArtiPACKED GitHub Actions token leakage

goshs was assigned CVE-2026-40903 for an ArtiPACKED-style GitHub Actions credential exposure. The vulnerable pattern occurs when workflow checkout credentials are persisted into .git/config and a later artifact upload can include the workspace or .git directory while the short-lived GITHUB_TOKEN is still valid. A downloader who retrieves that artifact during the job window can potentially use the token to push code, alter releases, or tamper with the software supply chain.

For downstream users, this is a provenance and artifact-trust issue as much as a package-version issue. Repositories that build, fork, package, mirror, or consume goshs should upgrade away from affected releases and verify that release artifacts, checksums, workflow artifacts, and GitHub Actions permissions do not preserve the vulnerable pattern.

This belongs in SecurityRecipes because CI artifacts are context. A secure context layer for agentic AI must treat generated artifacts, hidden Git config, release bundles, and workflow logs as controlled evidence, not harmless build byproducts.

Affected versions

  • Vulnerable: goshs before v2.0.0-beta.6 according to the CVE record
  • Explicitly called out by the upstream advisory: v2.0.0-beta.5
  • Fixed: v2.0.0-beta.6+; prefer stable v2.0.0+ where possible
  • Highest-risk condition: a goshs fork, package, release workflow, or related repository uses actions/checkout with persisted credentials and uploads artifacts that can include .git, the full workspace, or credential bearing metadata.

Indicator-of-exposure

  • The repository builds, packages, forks, mirrors, vendors, deploys, or verifies goshs.
  • A dependency, binary, package recipe, container, SBOM, or checksum resolves to goshs before v2.0.0-beta.6.
  • GitHub Actions workflows use actions/checkout without persist-credentials: false.
  • Workflows upload the whole workspace, source tree, test output collected from repository root, release directories, build caches, debug bundles, or arbitrary paths that may include .git.
  • Workflow permissions grant broad write access when only read access is needed.
  • Release or package provenance depends on artifacts created during the affected upstream window.

Quick checks:

rg -n "patrickhener/goshs|goshs|v2\\.0\\.0-beta\\.[0-5]|github.com/patrickhener/goshs" .
rg -n "actions/checkout|upload-artifact|download-artifact|artifact|persist-credentials|permissions:" .github/workflows
rg -n "\\.git|github-token|GITHUB_TOKEN|workspace|path:\\s*\\.|path:\\s*\\$\\{\\{ github.workspace \\}\\}" .github/workflows scripts Makefile* justfile* 2>/dev/null
go list -m all | rg "github.com/patrickhener/goshs"

Remediation strategy

  • Upgrade goshs references to v2.0.0+ or at least v2.0.0-beta.6+ where beta tracking is intentional.
  • Refresh checksums, SBOMs, provenance attestations, package recipes, and release metadata that include goshs.
  • In GitHub Actions workflows that build, package, mirror, or publish goshs, set persist-credentials: false on checkout steps unless a job truly needs authenticated git pushes.
  • Scope GITHUB_TOKEN with explicit least-privilege permissions.
  • Ensure uploaded artifacts exclude .git, hidden credential files, full workspaces, caches with repository metadata, and logs containing tokens.
  • If vulnerable artifacts were public or broadly accessible, expire artifacts, rotate exposed credentials or release tokens, review audit logs, and rebuild release artifacts from trusted sources.

The prompt 

Model context: this prompt was generated by GPT 5.5 Extra High reasoning.

You are remediating CVE-2026-40903 (goshs ArtiPACKED GitHub Actions token
leakage). Produce exactly one output:

- A reviewer-ready PR/change request that upgrades goshs, hardens GitHub
  Actions artifact handling, adds verification, and documents token/artifact
  cleanup, or
- TRIAGE.md if this repository does not own affected goshs usage, goshs
  packaging/release automation, or a safe patch path.

## Rules

- Scope only CVE-2026-40903 / GHSA-hpxj-9fgp-fhhf and directly related goshs
  artifact, provenance, and GitHub Actions hardening.
- Treat `GITHUB_TOKEN`, PATs, deploy keys, release tokens, `.git/config`,
  workflow logs, release artifacts, package checksums, SBOMs, provenance
  attestations, and build caches as sensitive.
- Do not download, inspect, print, or attach historical artifacts that may
  contain live or previously live credentials.
- Do not add broad workflow permissions to compensate for
  `persist-credentials: false`.
- Do not rewrite unrelated CI/CD architecture.
- Do not auto-merge.

## Steps

1. Inventory goshs ownership in this repository:
   Go manifests, vendored source, forks, package recipes, Nix files,
   Dockerfiles, release checksums, SBOMs, provenance attestations, mirrors,
   deployment manifests, build scripts, and generated artifacts.
2. Inventory GitHub Actions workflow exposure:
   - `actions/checkout` steps;
   - whether checkout sets `persist-credentials: false`;
   - `actions/upload-artifact` and custom artifact upload commands;
   - artifact paths that include `.`, `${{ github.workspace }}`, source root,
     `.git`, build caches, logs, release directories, or debug bundles;
   - job and workflow-level `permissions`;
   - release/publish jobs that can write tags, releases, packages, images, or
     deployment artifacts.
3. Determine every resolved goshs version. A target is vulnerable if it
   resolves to any version before `v2.0.0-beta.6`; prefer remediation to
   stable `v2.0.0+`.
4. If this repository does not use, package, fork, mirror, deploy, or verify
   goshs, stop with `TRIAGE.md` naming the files checked, why downstream
   exposure is not owned here, and the fixed target `goshs v2.0.0+` or
   `v2.0.0-beta.6+`.
5. Upgrade goshs references and regenerate every derived artifact this repo
   controls: lockfiles, checksums, SBOMs, package metadata, image tags/digests,
   provenance attestations, release manifests, and deployment evidence.
6. Harden GitHub Actions workflows that build, package, mirror, or publish
   goshs:
   - add `persist-credentials: false` to checkout steps unless an explicit
     authenticated push is required;
   - set explicit least-privilege `permissions`;
   - split read-only build jobs from release-writing jobs where practical;
   - prevent artifact uploads from including `.git`, full workspaces, hidden
     credentials, caches with repository metadata, or token-bearing logs;
   - prefer narrow artifact paths such as `dist/*.tar.gz`, `coverage/*.xml`,
     or generated reports with known contents.
7. Add workflow policy tests or static checks:
   - checkout in artifact-producing jobs must set `persist-credentials: false`;
   - artifact upload paths must not include `.git`, `.`, workspace root, or
     unrestricted globs;
   - write permissions are absent from non-release jobs;
   - release jobs document why write permissions are required.
8. Add safe artifact verification:
   - create a synthetic fixture or dry-run artifact manifest that proves `.git`
     is excluded;
   - run secret scanning against generated artifacts when the repository has a
     safe local build path;
   - verify no real token values are printed in logs.
9. Add a PR body section named `CVE-2026-40903 operator actions` that states:
   - goshs versions before and after the change;
   - which workflows used checkout credential persistence;
   - which artifacts could have included `.git` or workspace metadata;
   - whether historical artifacts should be expired or restricted;
   - whether repository tokens, deploy keys, release tokens, package tokens, or
     downstream release artifacts need rotation or rebuild;
   - which GitHub audit logs, workflow run logs, artifact download logs, and
     release events should be reviewed.
10. Run relevant validation: dependency resolution, package build, container
    build, workflow linting, static artifact-policy checks, SBOM refresh,
    checksum regeneration, provenance generation, secret scan, and any release
    dry-run available in this repository.
11. Use PR title:
    `fix(sec): remediate CVE-2026-40903 in goshs artifacts`.

## Stop conditions

- No goshs dependency, package, fork, mirror, release path, or deployment is
  controlled by this repository.
- This repository only consumes a fixed goshs release and does not depend on
  affected upstream artifacts.
- Historical artifact inspection would require downloading or printing
  credential-bearing artifacts.
- A release job genuinely needs credential persistence; document the need and
  isolate it from artifact-producing paths instead of silently accepting risk.
- Token rotation or artifact expiry requires repository-owner privileges not
  available to the agent; document the exact human action required.
- Validation fails for unrelated pre-existing reasons; document those failures
  instead of broadening scope.

Verification - what the reviewer looks for

  • No controlled dependency, package recipe, SBOM, checksum, image, or release manifest points at a vulnerable goshs version.
  • Artifact-producing workflow jobs use checkout without persisted credentials or have a documented reason and compensating containment.
  • Artifact upload paths cannot include .git, repository root, hidden credential files, or broad workspace dumps.
  • Workflow permissions are explicit and least privilege.
  • Operator actions address artifact expiry, audit review, token rotation, and release rebuilds when exposure was possible.

Watch for

  • Updating goshs versions while keeping old checksums, SBOM entries, package recipes, mirrors, or provenance attestations.
  • Adding persist-credentials: false to one checkout step while another artifact-producing job still uses the default.
  • Uploading . or ${{ github.workspace }} as a convenience artifact.
  • Treating GITHUB_TOKEN as harmless because it expires; the attack window is during the workflow run.
  • Printing .git/config or artifact contents in logs while proving the fix.

References