CVE-2020-26226 Secret disclosure in semantic-release
Attackers can view sensitive secrets in logs if they contain URL-encoded characters, affecting users of the semantic-release npm package.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-26226?
CVE-2020-26226 is a high-severity vulnerability in semantic-release, published on 18 Nov 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3.
Weakness: CWE-116
Which versions are affected by CVE-2020-26226?
2 open source packages ship an affected version, including semantic-release. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
semantic-release npm | All versions | 17.2.3 |
semantic-release npm | All versions | 17.2.3 |
Products include Semantic-Release Project Semantic-Release.
How do I fix CVE-2020-26226?
Upgrade semantic-release to 17.2.3 or later.
Is CVE-2020-26226 being exploited?
There is no known exploitation of CVE-2020-26226 in the wild and no public exploit code.
Other vulnerabilities in semantic-release
Sources
Also known as GHSA-r2j6-p67h-q639.