CVE-2022-31051

A vulnerability was found in semantic-release. Secrets that are normally masked are accidentally disclosed if they contain characters excluded from uri encoding by encodeURI(). The vulnerability is further limited to execution contexts where push access to the related repository is unavailable without modifying the repository URL to inject credentials.

Mitigation

Users should ensure that secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL that is already masked properly.