Semantic release 安全漏洞

漏洞信息详情

Semantic release是Semantic release团队的一个基于Js的版本管理和软件包发布工具。

npm semantic-release 17.2.3之前版本存在安全漏洞，该漏洞源于如果包含在URL中被编码的字符，就可能意外地泄露出来。

目前厂商已发布升级补丁以修复漏洞，补丁获取链接：

https://github.com/semantic-release/semantic-release/commit/ca90b34c4a9333438cc4d69faeb43362bb991e5a

来源:CONFIRM

链接:https://github.com/semantic-release/semantic-release/security/advisories/GHSA-r2j6-p67h-q639

来源:MISC

链接:https://github.com/semantic-release/semantic-release/commit/ca90b34c4a9333438cc4d69faeb43362bb991e5a

来源:nvd.nist.gov

链接:https://nvd.nist.gov/vuln/detail/CVE-2020-26226

暂无