CVE-2022-31051
1 advisory.
npm/semantic-release CVE-2022-31051: medium 4.4, EPSS 1.73%
Exposure of Sensitive Information to an Unauthorized Actor in semantic-release
Action: Upgrade semantic-release to 19.0.3 or later.
npm i semantic-release@19.0.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 17.0.4 | 19.0.3 | - |
Fixed versions
| 19.0.3 |
Sources
- osv: GHSA-x2pg-mjhr-2m5x
- https://github.com/semantic-release/semantic-release/security/advisories/GHSA-x2pg-mjhr-2m5x
- https://nvd.nist.gov/vuln/detail/CVE-2022-31051
- https://github.com/semantic-release/semantic-release/pull/2449
- https://github.com/semantic-release/semantic-release/pull/2459
- https://github.com/semantic-release/semantic-release/commit/58a226f29c04ee56bbb02cc661f020d568849cad
- https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURI
- https://github.com/semantic-release/semantic-release
- https://github.com/semantic-release/semantic-release/releases/tag/v19.0.3
CVE-2022-31051 · published · modified · JSON