GHSA-r2j6-p67h-q639

Suggest an improvement
Source
https://github.com/advisories/GHSA-r2j6-p67h-q639
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/11/GHSA-r2j6-p67h-q639/GHSA-r2j6-p67h-q639.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-r2j6-p67h-q639
Aliases
Related
Published
2020-11-18T21:19:14Z
Modified
2026-01-30T02:11:35.765514Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Secret disclosure when containing characters that become URI encoded
Details

Impact

Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL.

Patches

Fixed in v17.2.3

Workarounds

Secrets that do not contain characters that become encoded when included in a URL are already masked properly.

Database specific 
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-116"
    ],
    "github_reviewed_at": "2020-11-18T21:18:55Z",
    "github_reviewed": true,
    "severity": "HIGH"
}
References

Affected packages

npm / semantic-release

Package

Name
semantic-release
View open source insights on deps.dev
Purl
pkg:npm/semantic-release

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
17.2.3

Database specific

last_known_affected_version_range 
"<= 17.2.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/11/GHSA-r2j6-p67h-q639/GHSA-r2j6-p67h-q639.json"