CVE-2024-23840

GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.

• CWE-532

• https://github.com/goreleaser/goreleaser/commit/d5b6a533ca1dc3366983d5d31ee2d2b6232b83c0Patch
• https://github.com/goreleaser/goreleaser/security/advisories/GHSA-h3q2-8whx-c29hExploit, Vendor Advisory
• https://github.com/goreleaser/goreleaser/commit/d5b6a533ca1dc3366983d5d31ee2d2b6232b83c0Patch
• https://github.com/goreleaser/goreleaser/security/advisories/GHSA-h3q2-8whx-c29hExploit, Vendor Advisory

Published

Jan 30, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-23835Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-23836Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2024-23837LibHTP is a security-aware parser for the HTTP protocol. Cra…7.5
• CVE-2024-23838TrueLayer.NET is the .Net client for TrueLayer. The vulnera…7.5
• CVE-2024-23839Suricata is a network Intrusion Detection System, Intrusion …8.1
• CVE-2024-2384The WooCommerce POS plugin for WordPress is vulnerable to in…4.3
• CVE-2024-23841apollo-client-nextjs is the Apollo Client support for the Ne…6.1
• CVE-2024-23842Improper Input Validation in Hitron Systems DVR LGUVR-16H 1.…7.5
• CVE-2024-23843Improper Neutralization of Special Elements used in an SQL C…2.2
• CVE-2024-23847Incorrect default permissions issue exists in Unifier and Un…5.9
• CVE-2024-23848In the Linux kernel through 6.7.1, there is a use-after-free…5.5
• CVE-2024-23849In rds_recv_track_latency in net/rds/af_rds.c in the Linux k…5.5