CVE-2020-26226

Katalog CVE

CVSS 8.1 · High EPSS 1,4%

Kerentanan Improper Encoding or Escaping of Output pada semantic-release project semantic-release. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3.

Rincian

Terbit di NVD

18 November 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 71,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/semantic-release/semantic-release/commit/ca90b34c4a9333438cc4d69faeb43362bb991e5a patch · advisory pihak ketiga
• https://github.com/semantic-release/semantic-release/security/advisories/GHSA-r2j6-p67h-q639 advisory pihak ketiga