CVE-2020-26226: Semantic-Release Project Semantic-Release

High severity, CVSS 8.1. EPSS: 1.4% chance of exploitation in the next 30 days.

In the npm package semantic-release before version 17.2.3, secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL. Secrets that do not contain characters that become encoded when included in a URL are already masked properly. The issue is fixed in version 17.2.3.

Affected products

• Semantic-Release Project Semantic-Release: before 17.2.3 (fixed in 17.2.3)

Published 2020-11-18. Last modified 2026-06-17.