GHSA-r2j6-p67h-q639
Secret disclosure when containing characters that become URI encoded
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | semantic-release | < 17.2.3 | 17.2.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL.
### Patches
Fixed in v17.2.3
### Workarounds
Secrets that do not contain characters that become encoded when included in a URL are already masked properly.
References
External links from the advisory. They lead to third-party sites.