diff --git a/commit-to-output.js b/commit-to-output.js
index f11ab1a..d697ab8 100644
--- a/commit-to-output.js
+++ b/commit-to-output.js
@@ -98,7 +98,7 @@ function toStringMarkdown (data) {
 }
 
 function toStringMessageOnly (data) {
-  let cveData
+  let cveData = ''
   if (data.cveId) {
     cveData = `${data.cveId} - `
   }
diff --git a/test.js b/test.js
index 27fe14e..d87de79 100644
--- a/test.js
+++ b/test.js
@@ -142,3 +142,13 @@ test('test find-matching-prs', (t) => {
 `)
   t.end()
 })
+
+test('test group, CVE-ID', (t) => {
+  t.equal(exec('--start-ref=v4.1.1 --end-ref=12aa856 --group --filter-release --markdown'),
+`* \\[[\`35b762c78a\`](https://github.com/nodejs/changelog-maker/commit/35b762c78a)] - chore(release): 4.1.1 \\[skip ci] (semantic-release-bot)
+* \\[[\`736a899e9c\`](https://github.com/nodejs/changelog-maker/commit/736a899e9c)] - **feat**: add cveId support to commmit output (RafaelGSS)
+* \\[[\`9af0bbb77f\`](https://github.com/nodejs/changelog-maker/commit/9af0bbb77f)] - **(CVE-2024-22020)** **lib,esm**: handle bypass network-import via data: (RafaelGSS) [nodejs-private/node-private#522](https://github.com/nodejs-private/node-private/pull/522)
+* \\[[\`12aa8564c4\`](https://github.com/nodejs/changelog-maker/commit/12aa8564c4)] - **(CVE-2024-36138)** **src**: handle permissive extension on cmd check (RafaelGSS) [nodejs-private/node-private#596](https://github.com/nodejs-private/node-private/pull/596)
+`)
+  t.end()
+})