Kurz gesagt
- CVE-2020-26226 ist eine Schwachstelle (HOCH (CVSS 8.1)) in semantic-release (semantic-release project), semantic-release.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.4%, höher als bei 72.6% aller Schwachstellen.
- Abhilfe: auf 17.2.3 oder neuer aktualisieren.
Description
Impact
Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL.
Patches
Fixed in v17.2.3
Workarounds
Secrets that do not contain characters that become encoded when included in a URL are already masked properly.
NVD description
In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free