-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from logging a modified repository URL containing credentials. The commit 58a226f shows the fix replaced options.repositoryUrl with options.originalRepositoryURL in the log message. The original implementation used a URL that might have been altered to include credentials (which encodeURI doesn't fully sanitize), while the patched version uses the unmodified URL. This indicates the logging function using options.repositoryUrl was the exposure point for improperly masked secrets.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| semantic-release | npm | >= 17.0.4, < 19.0.3 | 19.0.3 |
JavaScriptJavaScript