GHSA-R2J6-P67H-Q639 Secret disclosure when containing characters that become URI encoded

Impact Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL. Patches Fixed in v17.2.3 Workarounds Secrets that do not contain characters that become encoded when included in a URL are already...

@arbetsmyra/semantic-release-config (>=1.0.2, <=1.1.4), @crystal-ball/semantic-release-base (>=2.13.0, <=2.22.0) +17 more potentially affected by CVE-2020-26226 via semantic-release (>=17.0.1, <=17.2.2)

semantic-release NPM version =17.0.1, =1.0.2, =2.13.0, =1.63.0, =2.0.0, =10.1.2, =1.2.0, =1.0.0, =1.4.0, =4.0.19, =8.0.0, =2.4.9, =10.0.0, =11.0.0 and more Source cves: CVE-2020-26226 Source advisory: OSV:GHSA-R2J6-P67H-Q639...

Semantic release security vulnerability

Semantic release is a Js-based versioning and package distribution tool from the Semantic release team. A security vulnerability exists in versions prior to npm semantic-release 17.2.3, which stems from the possibility of accidental disclosure if a character encoded in a URL is included...