Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.2
Goreleaser Leaks Environment Variables
published 2 years ago
Summary
Goreleaser accidentally prints sensitive environment variables in its log output, exposing credentials and tokens. This happens when the 'go build' output is non-empty. To fix this, update to the latest version of Goreleaser or use environment variables to mask sensitive information.
What to do
- Update github.com goreleaser to version 1.26.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | goreleaser |
1.26.0 Fix: upgrade to 1.26.1
|
Original advisory text
goreleaser shows environment by default
### Summary
Since #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the `go build` output is non-empty, goreleaser leaks the environment.
### PoC
* Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete `$GOPATH/pkg`).
* Make sure to have secrets set in the environment
* Make sure to not have `go mod tidy` in a before hook
* Run `goreleaser release --clean`
* Go prints lots of `go: downloading ...` lines, which triggers the "if output not empty, log it" line, which includes the environment.
### Impact
Credentials and tokens are leaked.
Since #4787 the log output is printed on the INFO level, while previously it was logged on DEBUG. This means if the `go build` output is non-empty, goreleaser leaks the environment.
### PoC
* Create a Go project with dependencies, do not pull them yet (or run goreleaser later in a container, or delete `$GOPATH/pkg`).
* Make sure to have secrets set in the environment
* Make sure to not have `go mod tidy` in a before hook
* Run `goreleaser release --clean`
* Go prints lots of `go: downloading ...` lines, which triggers the "if output not empty, log it" line, which includes the environment.
### Impact
Credentials and tokens are leaked.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-532Insertion of Sensitive Information into Log File
Timeline
Published15 May 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-f6mm-5fc7-3g3c · GHSA
Track software like this
Free during beta