https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T20:06:36.623486+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-45993 EUVD-2026-45993 2026-10-04T20:06:36.684542+00:00 EUVD-2026-45993 https://cve.radiocsirt.org/vuln/fkie_cve-2020-26226 fkie_cve-2020-26226 2026-10-04T20:06:36.684578+00:00

In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3.

 https://cve.radiocsirt.org/vuln/ghsa-r2j6-p67h-q639 GHSA-r2j6-p67h-q639 — Secret disclosure when containing characters that become URI encoded 2026-10-04T20:06:36.684612+00:00

Affected: npm: semantic-release

### Impact

Secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL.

### Patches

Fixed in v17.2.3

### Workarounds

Secrets that do not contain characters that become encoded when included in a URL are already masked properly.

 https://cve.radiocsirt.org/vuln/gsd-2020-26226 gsd-2020-26226 2026-10-04T20:06:36.684641+00:00 gsd-2020-26226