CVE-2024-23840: Goreleaser

Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days.

GoReleaser builds Go binaries for several platforms, creates a GitHub release and then pushes a Homebrew formula to a tap repository. `goreleaser release --debug` log shows secret values used in the in the custom publisher. This vulnerability is fixed in 1.24.0.

Affected products

• Goreleaser Goreleaser: version 1.23.0 only

Published 2024-01-30. Last modified 2026-06-17.