Read the docs
TI-2022-13096 Aliases CVE-2022-31051GHSA-x2pg-mjhr-2m5x

Exposure of Sensitive Information to an Unauthorized Actor in semantic-release

Priority LOW 36CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by `encodeURI`. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with `encodeURI` when included in a URL are already masked properly.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01798 78th percentileScored 2026-11-07
Fix Partial semantic-release (semantic-release): 19.0.3semantic-release (npm): 19.0.3Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
semantic-releasesemantic-release17.0.4 to before 19.0.319.0.3Patch availableCNA
—semantic-release (npm)17.0.4 to before 19.0.319.0.3Patch availableGHSA-x2pg-mjhr-2m5x
  • semantic-release Vendorsemantic-release Affected 17.0.4 to before 19.0.3 Fixed in 19.0.3 Patch available CNA
  • semantic-release (npm) Vendor— Affected 17.0.4 to before 19.0.3 Fixed in 19.0.3 Patch available GHSA-x2pg-mjhr-2m5x

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:semantic-release_project:semantic-release:*:*:*:*:*:*:*:*17.0.4 to before 19.0.3VulnerableSemantic-release Project
  • cpe:2.3:a:semantic-release_project:semantic-release:*:*:*:*:*:*:*:* Versions 17.0.4 to before 19.0.3 Vulnerable ·Semantic-release Project

Remediation

  • Fix · CNA semantic-release (semantic-release) Fixed in 19.0.3
  • Fix · GHSA-x2pg-mjhr-2m5x semantic-release (npm) Fixed in 19.0.3 Advisory →

Red Hat 1 advisory

  • RHSA-2022:5555 Released 2022-07-14 · Red Hat rating Moderate
    RHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 apache-commons-compress-1.21-1.2.el8ev, apache-commons-compress-javadoc-1.21-1.2.el8ev, ovirt-dependencies-4.5.2-1.el8ev +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Virtualization 4AffectedNo fix yet
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2022:5555
Not affected: 3 products
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat Directory Server 11
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31051
  2. 2026-10-03 Alias added: GHSA-x2pg-mjhr-2m5x

References

Patch 1

Advisory 4

Other 3

  • TI-2020-16047 Secret disclosure in semantic-release CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences