high8.1
CVE-2020-26226
Secret disclosure when containing characters that become URI encoded
Impact
### Impact Secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. ### Patches Fixed in v17.2.3 ### Workarounds Secrets that do not contain characters that become encoded when included in a URL are already masked properly.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | semantic-release | <= 17.2.2 | 17.2.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Semantic-Release Project | Semantic-Release | before 17.2.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/semantic-release/semantic-release/commit/ca90b34c4a9333438cc4d69faeb43362bb991e5a
- https://github.com/semantic-release/semantic-release/security/advisories/GHSA-r2j6-p67h-q639
- https://github.com/advisories/GHSA-r2j6-p67h-q639
- https://nvd.nist.gov/vuln/detail/CVE-2020-26226