What is GHSA-r2j6-p67h-q639?

GHSA-r2j6-p67h-q639 is a security advisory published by GitHub Security Advisories with High severity. Secret disclosure when containing characters that become URI encoded

Which CVE IDs does GHSA-r2j6-p67h-q639 cover?

GHSA-r2j6-p67h-q639 covers the following CVE IDs: CVE-2020-26226. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r2j6-p67h-q639?

GHSA-r2j6-p67h-q639 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-r2j6-p67h-q639?

GHSA-r2j6-p67h-q639 affects 1 product, including: npm/semantic-release:\u003c= 17.2.2.

GHSA-r2j6-p67h-q639HighCVSS 8.1

Secret disclosure when containing characters that become URI encoded

Vendor

GitHub Security Advisories

Published

November 18, 2020

Last Modified

January 9, 2023

🔗 CVE IDs covered (1)

CVE-2020-26226 →

📋 Description

Impact

Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL.

Patches

Fixed in v17.2.3

Workarounds

Secrets that do not contain characters that become encoded when included in a URL are already masked properly.

🎯 Affected products1

npm/semantic-release:<= 17.2.2

🔗 References (4)

https://github.com/semantic-release/semantic-release/security/advisories/GHSA-r2j6-p67h-q639
https://nvd.nist.gov/vuln/detail/CVE-2020-26226
https://github.com/semantic-release/semantic-release/commit/ca90b34c4a9333438cc4d69faeb43362bb991e5a
https://github.com/advisories/GHSA-r2j6-p67h-q639