CVE-2020-26226: 
JavaScript vulnerability analysis and mitigation

In the npm package semantic-release before version 17.2.3, a high-severity vulnerability was discovered where secrets that would normally be masked could be accidentally disclosed if they contained characters that become encoded when included in a URL. The vulnerability was identified on November 16, 2020, and was assigned CVE-2020-26226 (GitHub Advisory).

The vulnerability stems from an implementation flaw in the secret masking functionality. When secrets contain characters that become URI encoded when included in URLs, the masking mechanism failed to identify and mask these encoded versions of the secrets. This issue was particularly concerning for secrets containing special characters or spaces that would typically be URL encoded (GitHub Commit).

The vulnerability could lead to the exposure of sensitive information such as tokens, passwords, credentials, and other secrets that would normally be masked by semantic-release. This exposure occurs specifically when these secrets contain characters that become encoded in URLs, potentially revealing confidential information in logs or other outputs (GitHub Advisory).

The vulnerability can be exploited when secrets containing URL-encodable characters are used within the application. The risk is particularly high as it bypasses the intended security measure of masking sensitive information, potentially exposing secrets in environments where logs or outputs are accessible to unauthorized parties (GitHub Advisory).

The vulnerability was patched in version 17.2.3 of semantic-release. As a temporary workaround before updating, users can ensure that secrets do not contain characters that become encoded when included in URLs, as these are properly masked by the existing functionality. However, upgrading to version 17.2.3 or later is strongly recommended for complete protection (GitHub Advisory).