High severity8.1NVD Advisory· Published Nov 18, 2020· Updated Jun 17, 2026
CVE-2020-26226
CVE-2020-26226
Description
In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
semantic-releasenpm | < 17.2.3 | 17.2.3 |
Affected products
3- cpe:2.3:a:semantic-release_project:semantic-release:*:*:*:*:*:*:*:*Range: <17.2.3
- Range: < 6.1.5
Patches
Vulnerability mechanics
References
4- github.com/semantic-release/semantic-release/commit/ca90b34c4a9333438cc4d69faeb43362bb991e5anvdPatchThird Party AdvisoryWEB
- github.com/advisories/GHSA-r2j6-p67h-q639ghsaADVISORY
- github.com/semantic-release/semantic-release/security/advisories/GHSA-r2j6-p67h-q639nvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2020-26226ghsaADVISORY
News mentions
0No linked articles in our index yet.