GitHub Advisoryadvisory · npm

GHSA-r2j6-p67h-q639 Secret disclosure when containing characters that become URI encoded

HIGH Published 2020-11-18 Modified 2021-01-07 Official page ↗
Aliases
CVE-2020-26226
Ecosystem
npm
Packages
semantic-release
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-116
Reviewed
2020-11-18

Affected packages

• npm semantic-release: < 17.2.3 → fixed in 17.2.3

Description

Impact Secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Patches Fixed in v17.2.3 Workarounds Secrets that do not contain characters that become encoded when included in a URL are already masked properly.

Related

Alias · CVE (1)

  • CVE-2020-26226 In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally… vulnerability

Weakness · CWE (1)

  • CWE-116 Improper Encoding or Escaping of Output weakness

References