Skip to content
Fencer Vulns
medium 4.4

CVE-2022-31051 json

Exposure of Sensitive Information to an Unauthorized Actor in semantic-release

published 2022-06-09 4 y ago modified 2026-06-17 4 mo ago also GHSA-x2pg-mjhr-2m5x , EUVD-2022-6180

cvss
4.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by `encodeURI`. Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials. Users are advised to upgrade. Users unable to upgrade should ensure that secrets that do not contain characters that are excluded from encoding with `encodeURI` when included in a URL are already masked properly.

Patch / fix

  • npm semantic-release 19.0.3
  • semantic-release_project semantic-release 19.0.3
  • ovirt-web-ui rhev manager 4.4 1.9.0-1.el8ev
  • ovirt-dependencies rhev manager 4.4 4.5.2-1.el8ev
  • apache-commons-compress rhev manager 4.4 1.21-1.2.el8ev
  • apache-commons-compress-javadoc rhev manager 4.4 1.21-1.2.el8ev

red hat advisories RHSA-2022:5555

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-31051 updated cvss 7.5

semantic-release: Masked secrets can be disclosed if they contain characters that are excluded from uri encoding

  • Red Hat Virtualization 4 ovirt-engine-ui-extensions
    affected: workaround, no fix available “Users should ensure that secrets that do not contain characters that are excluded from encoding with `encodeURI` when included in a URL that is already masked properly.”
  • Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-web-ui 1.9.0-1.el8ev
    fixed: vendor fix “Users should ensure that secrets that do not contain characters that are excluded from encoding with `encodeURI` when included in a URL that is already masked properly.” RHSA-2022:5555
  • Red Hat Directory Server 11 389-ds-base Red Hat Enterprise Linux 8 cockpit, cockpit-ws, 389-ds-base, cockpit-pcp, cockpit-389-ds, cockpit-bridge, +10 more Red Hat RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 rhvm 4.5.1.2-0.11.el8ev, ovirt-engine-dwh 4.5.3-1.el8ev, ovirt-engine 4.5.1.2-0.11.el8ev, postgresql-jdbc 42.2.14-1.el8ev, rhvm-branding-rhv 4.5.0-1.el8ev, ovirt-dependencies 4.5.2-1.el8ev, +26 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.80% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.1 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
npm semantic-release
>=17.0.4, <19.0.3
19.0.3

Affected products

  • semantic-release semantic-release

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.