Every CVE Search/ Get API key

CVE-2022-31051

Exposure of Sensitive Information to an Unauthorized Actor in semantic-release

4.4 MediumFix available

semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL are already masked properly.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

1.80%Up 0.2 points since Jun 10, 2022
90%50%10%1%

What each source reports

CVE List Score used 4.4

Exposure of Sensitive Information to an Unauthorized Actor in semantic-release

semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL are already masked properly.

Record
CVE-2022-31051
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2022-6180 4.4

semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL are already masked properly.

Record
EUVD-2022-6180
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-x2pg-mjhr-2m5x 4.4

Exposure of Sensitive Information to an Unauthorized Actor in semantic-release

Impact

What kind of vulnerability is it? Who is impacted?

Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials.

Patches

Has the problem been patched? What versions should users upgrade to?

Fixed in 19.0.3

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL are already masked properly.

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

Record
GHSA-x2pg-mjhr-2m5x
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
NVD 4.4

semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL are already masked properly.

Record
CVE-2022-31051
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 4.4

Exposure of Sensitive Information to an Unauthorized Actor in semantic-release

semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL are already masked properly.

Record
CVE-2022-31051
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVGHSA-x2pg-mjhr-2m5x 4.4

Exposure of Sensitive Information to an Unauthorized Actor in semantic-release

Impact

What kind of vulnerability is it? Who is impacted?

Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by encodeURI. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials.

Patches

Has the problem been patched? What versions should users upgrade to?

Fixed in 19.0.3

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

Secrets that do not contain characters that are excluded from encoding with encodeURI when included in a URL are already masked properly.

References

Are there any links users can visit to find out more?

For more information

If you have any questions or comments about this advisory:

Record
GHSA-x2pg-mjhr-2m5x
CVSS 3.1
4.4 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVRHSA-2022:5555 7.5

Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update

Record
RHSA-2022:5555
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
semantic-release
npm
 17.0.4 up to 19.0.3
19.0.3
ovirt-web-ui
Red Hat:rhev_manager:4.4:el8
From an advisory covering 9 CVEs
 before 0:1.9.0-1.el8ev
0:1.9.0-1.el8ev
ovirt-dependencies
Red Hat:rhev_manager:4.4:el8
From an advisory covering 9 CVEs
 before 0:4.5.2-1.el8ev
0:4.5.2-1.el8ev
apache-commons-compress
Red Hat:rhev_manager:4.4:el8
From an advisory covering 9 CVEs
 before 0:1.21-1.2.el8ev
0:1.21-1.2.el8ev
apache-commons-compress-javadoc
Red Hat:rhev_manager:4.4:el8
From an advisory covering 9 CVEs
 before 0:1.21-1.2.el8ev
0:1.21-1.2.el8ev

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-31051 is a medium vulnerability (CVSS 4.4) in Semantic-release, published June 9, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.80%, the 78th percentile. Fixed in semantic-release 19.0.3.

References

Show 74 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open