Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

semantic-release

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.4npmAmendedPublished

    Exposure of Sensitive Information to an Unauthorized Actor in semantic-release

    CVE-2022-31051 · GHSA-x2pg-mjhr-2m5x

    Affected
    • npm semantic-release >= 17.0.4, < 19.0.3
    Fixed in
    19.0.3· Vendor fix available
    Issue
    Impact What kind of vulnerability is it? Who is impacted? Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Patches Has the problem been patched? What versions should users upgrade to? Fixed in 19.0.3 Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading? Secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL are already masked properly. References Are there any links users can visit to find out more? https://github.com/semantic-release/semantic-release/releases/tag/v19.0.3 https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/GlobalObjects/encodeURI For more information If you have any questions…

    Recommended action: Upgrade to 19.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. High, CVSS 8.1npmAmendedPublished

    Secret disclosure when containing characters that become URI encoded

    CVE-2020-26226 · GHSA-r2j6-p67h-q639

    Affected
    • npm semantic-release <= 17.2.2
    Fixed in
    17.2.3· Vendor fix available
    Issue
    Impact Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL. Patches Fixed in v17.2.3 Workarounds Secrets that do not contain characters that become encoded when included in a URL are already masked properly.

    Recommended action: Upgrade to 17.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →