CVE-2026-40903: 
NixOS vulnerability analysis and mitigation

CVE-2026-40903 is an ArtiPACKED credential persistence vulnerability in goshs, a SimpleHTTPServer written in Go. It affects all versions prior to 2.0.0-beta.6, including beta releases 1 through 5. The flaw allows leakage of the GITHUB_TOKEN through GitHub Actions workflow artifacts, even when the token is not explicitly present in the repository source code. It was published on April 21, 2026, with a fix released in version 2.0.0-beta.6. It carries a CVSS v3.1 base score of 9.1 (Critical) (GitHub Advisory).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and stems from the default behavior of the actions/checkout GitHub Action, which sets persist-credentials: true by default. This causes the temporary GITHUB_TOKEN — injected at runtime by GitHub into the CI runner — to be written into the hidden .git/config file within the workspace. If any subsequent workflow step uploads an artifact that includes the .git directory (e.g., build outputs, test results, or workspace archives), the token becomes embedded in a publicly downloadable artifact. A security audit using the zizmor tool identified this issue in two goshs workflows: .github/workflows/codeql-analysis.yml (line 40) and .github/workflows/release.yml (line 19). The same audit also flagged 8 high-severity unpinned action references in those workflows (GitHub Advisory).

Successful exploitation enables an unauthenticated network attacker to extract a valid GITHUB_TOKEN from a publicly downloadable workflow artifact during a race condition window while the workflow is still running. With this token, an attacker can push malicious code to the main branch, poison releases or packages, create pull requests, exfiltrate other repository secrets, or achieve full supply-chain compromise affecting all downstream users of goshs. The vulnerability has high confidentiality and integrity impacts with no availability impact (GitHub Advisory).

There is no public proof-of-concept exploit specifically targeting this CVE, and no evidence of active in-the-wild exploitation has been observed (Feedly). The underlying ArtiPACKED technique was originally researched and disclosed by Palo Alto Networks Unit 42 in August 2024, and the general attack methodology is publicly documented. The EPSS score is approximately 0.031% (0.000310), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify that the target goshs repository uses GitHub Actions workflows (codeql-analysis.yml, release.yml) with actions/checkout and that the repository is public, making artifacts downloadable.
2. Monitor workflow execution: Watch the repository's Actions tab for a workflow run to begin (e.g., triggered by a tag push for a release or a code push triggering CodeQL analysis).
3. Wait for artifact upload: Allow the workflow to progress until a step uploads an artifact that includes the workspace or .git directory, embedding the runtime GITHUB_TOKEN in .git/config.
4. Download the artifact: While the workflow job is still running (before the token expires), download the publicly available artifact via the GitHub UI or API (e.g., GET /repos/{owner}/{repo}/actions/runs/{run_id}/artifacts).
5. Extract the token: Unzip the artifact and read the token from .git/config (typically under the [http] section as extraheader = Authorization: basic <base64-encoded-token>).
6. Abuse the token: Use the extracted GITHUB_TOKEN within its validity window to push malicious commits, create releases, or exfiltrate secrets before the original workflow job ends and invalidates the token (GitHub Advisory).

• Network: Unexpected or anonymous API requests to GET /repos/patrickhener/goshs/actions/runs/{run_id}/artifacts or artifact download endpoints during active workflow runs.
• Logs: GitHub audit log entries showing artifact downloads by unknown or unauthenticated users during workflow execution windows; API calls using a GITHUB_TOKEN from an IP address not associated with the repository owner or CI infrastructure.
• File System: Presence of .git/config containing extraheader = Authorization: basic ... within uploaded workflow artifacts.
• Process/Behavior: Unexpected git push, branch creation, or PR creation events in the repository timeline occurring during or immediately after a workflow run, potentially indicating token abuse.

Upgrade goshs to version 2.0.0-beta.6 or later, which resolves this vulnerability. As an immediate workaround, add persist-credentials: false to every actions/checkout step in affected workflows to prevent the token from being written to .git/config. Additionally, rotate any GITHUB_TOKEN credentials that may have been exposed, audit workflow artifact contents and access logs for unauthorized downloads, and pin all GitHub Actions references to full commit SHAs to address the related high-severity unpinned action findings (GitHub Advisory).

The vulnerability was reported to the goshs project by security researcher jaisurya-me using the zizmor static analysis tool for GitHub Actions. The advisory references the original ArtiPACKED research by Palo Alto Networks Unit 42 (August 2024) and associated news coverage. A Mastodon post by @thehackerwire noted the disclosure, and a technical write-up was published at infinitsec.net covering the ArtiPACKED vulnerability and GitHub Actions credential persistence context (GitHub Advisory).